agenttesla

General

Target

Quotation - HDPE Fittings.rar
Size

634KB
Sample

240329-v81kcadh2x
MD5

7375bb704bd5f629d65d0d65d6866254
SHA1

4078912290a256755f5d9f475141056499b9e755
SHA256

5b613734e447fc4f4905676fe530a1196c7292d410e5d88496c39ee10c2cfbef
SHA512

efca5a01f3a7a0fe9ca2cee2a4808cbd5dbdb8516c60c48c7dd1aa65b360d3238934b67f149b3a1c728c34c6b56703cbf3c2494c81417df527ed7eb43d767bc8
SSDEEP

12288:3eceY+6d88LlSEuJCkh/6FXIQMSaaSAN0lac4oaOFTO5mbu:ucv8OlEYkhyFXIQMSaaSA+arAp1u

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
K@fYQ*o1
Email To:
[email protected]

Extracted

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
K@fYQ*o1

Targets

- Target
  
  Quotation - HDPE Fittings.exe
- Size
  
  667KB
- MD5
  
  10f4c53cf6490bcf1f1cf0f3a88250de
- SHA1
  
  4e9d7fd3c9651c205f72a6c696c656e7ae84a9d8
- SHA256
  
  af83c0d8ccb38c430dce3b0c4a18eeda3c91832ae8bb432a9614619fd5727e7b
- SHA512
  
  24b71b5339000c364858c137a7955cd7b464466da658ccb44c3659bedc55dcab89c185ceeb2bc5debd42d0e34ffd01f0f81d761c6a22e11dbc70bdd7786f30d5
- SSDEEP
  
  12288:JBLK1sKjd9+wrOGCZ8SBvAxi/MgUd7YN0hMJqGcIlHI16CDYWEVy4Zw13vHruup:JBisKjdTOGu8SVIsmqaM7lHw6COtw1fr
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

Lateral Movement

Collection

Data from Local System

4

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2