agenttesla

General

Target

e21851f345852a13efc73fbe317bdc92a5ebe181dad93c0b49769db732617c56
Size

366KB
Sample

240425-cpppmade28
MD5

afd1fc772108ec75091d6b762558d811
SHA1

d7f599ca494eaeb95908a67bff0d5ac0da91779d
SHA256

e21851f345852a13efc73fbe317bdc92a5ebe181dad93c0b49769db732617c56
SHA512

85f7e1463e7a4d5e3c2bf786f2ba524e6cf957d519689fa9c5b4ae55264f84a1516a99d0ccc16bfc5929764791ab3a6caca27fb5d55a983946b3460fccba1c7b
SSDEEP

6144:H3nLr8XH2saC7yep2qX+mW1vlF7bPKMXRVvV1Z85ZibG6Gwn9oJ5:H3f832fjqGN52MBVvnZhbG6G

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.jarnesway.com
Port:
587
Username:
[email protected]
Password:
Blocknation07
Email To:
[email protected]

Extracted

Credentials

Protocol: smtp
Host:
mail.jarnesway.com
Port:
587
Username:
[email protected]
Password:
Blocknation07

Targets

- Target
  
  e21851f345852a13efc73fbe317bdc92a5ebe181dad93c0b49769db732617c56
- Size
  
  366KB
- MD5
  
  afd1fc772108ec75091d6b762558d811
- SHA1
  
  d7f599ca494eaeb95908a67bff0d5ac0da91779d
- SHA256
  
  e21851f345852a13efc73fbe317bdc92a5ebe181dad93c0b49769db732617c56
- SHA512
  
  85f7e1463e7a4d5e3c2bf786f2ba524e6cf957d519689fa9c5b4ae55264f84a1516a99d0ccc16bfc5929764791ab3a6caca27fb5d55a983946b3460fccba1c7b
- SSDEEP
  
  6144:H3nLr8XH2saC7yep2qX+mW1vlF7bPKMXRVvV1Z85ZibG6Gwn9oJ5:H3f832fjqGN52MBVvnZhbG6G
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2