agenttesla

General

Target

c690e716350cf43a91a24752f428f0a0034be02ad89b5743d60bef19729e33a2
Size

2.1MB
Sample

240118-bjvs1saef6
MD5

a1e399b47e1fd1e30a78133556b68153
SHA1

8305635e061cd23bdf514e19ecb12060781363c9
SHA256

c690e716350cf43a91a24752f428f0a0034be02ad89b5743d60bef19729e33a2
SHA512

92c3fbc29b57ebda5f3486745a90d92b2aa8885baa6229f728256c81d3708c122b298954f013fd22615aec4e1a9491aae30df4dd006bbb4477fc4acd94547d6a
SSDEEP

12288:xiaEEC3OrANkKSl47g/qq2GUviSEpCXc4ZIW6C4rDGbtDgJssBxkTpPmJQWy+t/R:sZKPg82epjexkGFo5ePwr0V1nA

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.icemp.eu
Port:
21
Username:
[email protected]
Password:
bVkMH6R.pfF~NN@ossy$W!_pz[bh!9l(MU%UtX9L^W}vO=mn*g*;]}]Aq]-jKJ+CcP&U;d{f4thp)[y_^[!$Y

Targets

- Target
  
  DĄBROWSKI_N.24010011792.exe
- Size
  
  1.6MB
- MD5
  
  6c744e7f58bd987d6603fefb15c14218
- SHA1
  
  fbf81d20cac4977119e55b2b605f0df57a5e0a02
- SHA256
  
  7fa62d345c56f3f8c6905967534b4fd113568298e8704fe9d9ba0473cadecd9f
- SHA512
  
  5487dd5dbf7407ed83a5c4396427111c0293fd2d62cfc1c188ef0ea2f38599066a45ff0c5d87ced0263f6560f996403cccaa02b1895d2ae3a0c33dcf06fd3f13
- SSDEEP
  
  12288:BiaEEC3OrANkKSl47g/qq2GUviSEpCXc4ZIW6C4rDGbtDgJssBxkTpPmJQWy+t/R:cZKPg82epjexkGFo5ePwr0V1nA
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2