agenttesla

General

Target
1709572324fc61a57503b4e7923083f394d2c7056db56d1cbf28169de3b6fb3850adf86696460.dat-decoded.exe
Size 239KB
Sample240304-vreasafg5s
SHA256 0a7ed7874b472f88b5d20a911c35ba4eb3c973ad384920485ea360ade4bcfaca
MD5 41a05027ae1abc87471806912d541084
SHA1 498dbb5ca1454c9d24417ec753f6b4d19df43d37
SHA512 6b5d68d68f7008833b3150cdbe252082c856600680cee15283e82bfb7e75cd597a3c0c91dd63159448f76fcdda8bbc95dde88dd2efca52c38f1232b8eb9ddf35
SSDEEP 3072:70h/QEgsg2dnI0feplAMNX7D3U7G55kAI4Q5XMVdVJy9jAh:YNQEgsg2dnhehRHU7GcA/bVy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
3dlens.net
Port
587
Username
[email protected]
Password
Bukky101@
Email to
[email protected]

Extracted

Credentials

Protocol
smtp
Host
3dlens.net
Port
587
Username
[email protected]
Password
Bukky101@

Targets

- Target
  1709572324fc61a57503b4e7923083f394d2c7056db56d1cbf28169de3b6fb3850adf86696460.dat-decoded.exe
- Size 239KB
- SHA256 0a7ed7874b472f88b5d20a911c35ba4eb3c973ad384920485ea360ade4bcfaca
- MD5 41a05027ae1abc87471806912d541084
- SHA1 498dbb5ca1454c9d24417ec753f6b4d19df43d37
- SHA512 6b5d68d68f7008833b3150cdbe252082c856600680cee15283e82bfb7e75cd597a3c0c91dd63159448f76fcdda8bbc95dde88dd2efca52c38f1232b8eb9ddf35
- SSDEEP 3072:70h/QEgsg2dnI0feplAMNX7D3U7G55kAI4Q5XMVdVJy9jAh:YNQEgsg2dnhehRHU7GcA/bVy
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Looks up external IP address via web service

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2