agenttesla

General

Target

259206e6fbda6b46e6499e518adcaf96
Size

613KB
Sample

231231-djh6bsdcfq
MD5

259206e6fbda6b46e6499e518adcaf96
SHA1

3c2a4bb622685d3e250d4566d25aa244e18f0086
SHA256

fed60d381e993a084cbde0147f445309d00a69b6be01aeebace31acdb424a91f
SHA512

9f2d873a853ed0494cb7326286c0dd2e338b5422ecbd221f9bda831a205953ece096e297c248a89f477f7e89755b204ab7181fb2c991df489e3270b62aa42c6f
SSDEEP

12288:H12OsBgo0q4wM/VkGjkfoX89JrFM02XweWFdPcYiQAqwQikKCTwE47:4OsBgo0q4wM2ykfosfriwPFdPKQAqwMn

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.ggraco.com
Port:
587
Username:
[email protected]
Password:
admin@#1235

Targets

- Target
  
  259206e6fbda6b46e6499e518adcaf96
- Size
  
  613KB
- MD5
  
  259206e6fbda6b46e6499e518adcaf96
- SHA1
  
  3c2a4bb622685d3e250d4566d25aa244e18f0086
- SHA256
  
  fed60d381e993a084cbde0147f445309d00a69b6be01aeebace31acdb424a91f
- SHA512
  
  9f2d873a853ed0494cb7326286c0dd2e338b5422ecbd221f9bda831a205953ece096e297c248a89f477f7e89755b204ab7181fb2c991df489e3270b62aa42c6f
- SSDEEP
  
  12288:H12OsBgo0q4wM/VkGjkfoX89JrFM02XweWFdPcYiQAqwQikKCTwE47:4OsBgo0q4wM2ykfosfriwPFdPKQAqwMn
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- CustAttr .NET packer
  Detects CustAttr .NET packer in memory.
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla payload

CustAttr .NET packer

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2