agenttesla | 5e52157e7f34c53ba4883b2a7cb26b6bc80e03abe2c5279c6227994cb1b8c185 | Triage

Sharing

General

Target

e4551429328c43301d6875937a530b03
Size

12KB
Sample

240424-j4wvtafh9x
MD5

e4551429328c43301d6875937a530b03
SHA1

f867aa53c8e1ef5adfded27677f52c931e40ad94
SHA256

5e52157e7f34c53ba4883b2a7cb26b6bc80e03abe2c5279c6227994cb1b8c185
SHA512

95a1792324c5c9048421dcdc276ef1388e9832b46a5387582a591922f66322307fb4f3e7b6a0e448b17a34280044eaebc38ae6237a9db82fab209c7b8e2a8af8
SSDEEP

384:btwX5ZVoY9f9DRfcMzYd+mcSGruW3j/BeH+O6Rg3VpPgRlVNZb2w5v:SVNVNRfHYg3SGiW3j/BtxSV2Tq8

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.innomedjsc.com
Port:
587
Username:
[email protected]
Password:
s]~5ai)IFpr-
Email To:
[email protected]

Targets

- Target
  
  e4551429328c43301d6875937a530b03
- Size
  
  12KB
- MD5
  
  e4551429328c43301d6875937a530b03
- SHA1
  
  f867aa53c8e1ef5adfded27677f52c931e40ad94
- SHA256
  
  5e52157e7f34c53ba4883b2a7cb26b6bc80e03abe2c5279c6227994cb1b8c185
- SHA512
  
  95a1792324c5c9048421dcdc276ef1388e9832b46a5387582a591922f66322307fb4f3e7b6a0e448b17a34280044eaebc38ae6237a9db82fab209c7b8e2a8af8
- SSDEEP
  
  384:btwX5ZVoY9f9DRfcMzYd+mcSGruW3j/BeH+O6Rg3VpPgRlVNZb2w5v:SVNVNRfHYg3SGiW3j/BtxSV2Tq8
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

agentteslakeyloggerspywarestealertrojan