agenttesla

General

Target

RECIBO DE ENTREGA____html.xz
Size

256KB
Sample

240327-t3hlxabd31
MD5

635b72690054f70e431c115a9e743c4a
SHA1

a2f62c0e11f93c705a918d01c57ee98a541833d9
SHA256

a9ef2fe051be97565c10190979dcb593e83b529af23c9cc48838861138056afa
SHA512

516de3258a40494da748ed964c4aa281db16a2644c812455e39e28b5acaf0ce6e32782d384aff3917fa11fa7c766c41101c6303237667808b75c37b9e5187ade
SSDEEP

6144:mdkFD8Ql39SJf9kFgoYq/OhBL9IdnFjRSKhkSUIcGCQ:mqFDH+N9LkOhqtFkS8Q

Score

10^/10

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6597010543:AAEDzMHM1RryGmTUD_ntBw5X7Q39X0ZRh5U/

Targets

- Target
  
  RECIBO DE ENTREGA____html
- Size
  
  339KB
- MD5
  
  9a0caf2197bdb10e261147677f2bdade
- SHA1
  
  aab71ad7ed4c8bcc24d2b51e5c99859c58006ee7
- SHA256
  
  535f823b8bcacbf81fabc8f4c9e83d7e161b98b856600146d2a9ca1f2d5b3fc3
- SHA512
  
  f455bc7ae7070294af775ef1141c36da50e62f9951ea043c2e17339e74b781db3b7e876faab8950262a063580fc752c74fc0e2295c4cc16f37d40e531513c08f
- SSDEEP
  
  6144:jlfHL2a1JcbHfyiLDqprB/9fhXw3r6RkCUKuhP23sntfKslnsqPc6K:5aSinqD/1hA3r6kK4PwMfV7K
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

Lateral Movement

Collection

Data from Local System

4

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2