agenttesla

General

Target

206b4b5ab8a00697a7161de7822d5235e4f9d913e57e503673cc0437c2ddceb0.exe
Size

643KB
Sample

240329-cj55eseh5z
MD5

c45c19b5790cf57045ce3f8222c412f2
SHA1

818996bc52b3ff2d17620bb8d4902d80e7643ab6
SHA256

206b4b5ab8a00697a7161de7822d5235e4f9d913e57e503673cc0437c2ddceb0
SHA512

b87a5db0dbc25ff7b9331598607f6bca602e8167cb002adfd123d541665ff7c8fd0b88a68a990f33e3f28926b7bb2918e4054d6c1924a2eb0b42788d4e588107
SSDEEP

12288:wY5qjl5sV3opXxW603Hioen6ZH6i4bgc6ZLXgf4Kx6IF0TGLqk98h:wY5mvXUH30n656iXD6GIFlrO

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.gosportz.in
Port:
587
Username:
[email protected]
Password:
Ss@gosportz
Email To:
[email protected]

Targets

- Target
  
  206b4b5ab8a00697a7161de7822d5235e4f9d913e57e503673cc0437c2ddceb0.exe
- Size
  
  643KB
- MD5
  
  c45c19b5790cf57045ce3f8222c412f2
- SHA1
  
  818996bc52b3ff2d17620bb8d4902d80e7643ab6
- SHA256
  
  206b4b5ab8a00697a7161de7822d5235e4f9d913e57e503673cc0437c2ddceb0
- SHA512
  
  b87a5db0dbc25ff7b9331598607f6bca602e8167cb002adfd123d541665ff7c8fd0b88a68a990f33e3f28926b7bb2918e4054d6c1924a2eb0b42788d4e588107
- SSDEEP
  
  12288:wY5qjl5sV3opXxW603Hioen6ZH6i4bgc6ZLXgf4Kx6IF0TGLqk98h:wY5mvXUH30n656iXD6GIFlrO
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Detect packed .NET executables. Mostly AgentTeslaV4.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
- Detects executables packed with or use KoiVM
- Detects executables referencing Windows vault credential objects. Observed in infostealers
- Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
- Detects executables referencing many email and collaboration clients. Observed in information stealers
- Detects executables referencing many file transfer clients. Observed in information stealers
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect packed .NET executables. Mostly AgentTeslaV4.

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Detects executables packed with or use KoiVM

Detects executables referencing Windows vault credential objects. Observed in infostealers

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Detects executables referencing many email and collaboration clients. Observed in information stealers

Detects executables referencing many file transfer clients. Observed in information stealers

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2