agenttesla

General

Target

3c6e1320fc96e3ca429fb909b6166c130916910da093b1cb0900f9ead0fbc7d6
Size

634KB
Sample

231207-cw4r5aadf3
MD5

47a6ff219be13281d24f167e463ea0ec
SHA1

48e38e28e2c5839bf63222eb3c07c3d6e85d624c
SHA256

3c6e1320fc96e3ca429fb909b6166c130916910da093b1cb0900f9ead0fbc7d6
SHA512

82f256369a28be171bd5fa31b06d2a3f2f7d99c88b06a72d85ce6fee180c42a3f53b60978d67fe7022126a73969bd66c71a3f19ce45ab911af75718184d9199b
SSDEEP

12288:8glblufLgvRIix56Pi7vV38c19hRji71I5X9D/aII+oou:8IlU0vRjxcPQr8OdR/Wou

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.sarahfoils.com
Port:
587
Username:
[email protected]
Password:
Scalatica01
Email To:
[email protected]

Extracted

Credentials

Protocol: smtp
Host:
mail.sarahfoils.com
Port:
587
Username:
[email protected]
Password:
Scalatica01

Targets

- Target
  
  DOCUMENT 82822-28-ND.exe
- Size
  
  854KB
- MD5
  
  f1c29a78359e767adbd42221ba8b7b56
- SHA1
  
  4e58abe556bb71a5596fb9e5b098028e8acdce69
- SHA256
  
  e9cbd624aa2f7a22f007f7bb3c9a3e9ffb857a80db1a10427d5b8ec50244871b
- SHA512
  
  e16e6a7ea1a78a5fdcd592a7bb7206c297114b342dc53a789eed32989de4347ea8445920099eb065fdd151aabce42715590c0f872f211875cbeaad837f360b8f
- SSDEEP
  
  12288:ZCueH5qPLOZRIiD013VVAcXVhRzozvIjfOcr7UVIZg4+K:oqPqZRjD2foATV3UeOFK
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2