agenttesla | 274627e3d40b83de75102b3e9c8a564e08426d4fc950b0a0328eb0b67181ae2b | Triage

Sharing

General

Target

16893023379.zip
Size

1.9MB
Sample

240429-k8tfxsfa25
MD5

b8006ac54f023624595cb42e1a681f84
SHA1

810fb83351f388d8d6bfb5afdb5949603a555a19
SHA256

274627e3d40b83de75102b3e9c8a564e08426d4fc950b0a0328eb0b67181ae2b
SHA512

f18eeb8d8f593fbd9cbc85c30ac3f7229f5fd3c6f94cc2b651d4881a010ead5b6702ff6521f1639785bcbcb4b04eaf2141e87aa5ba2ebd94bfe0d18362b30767
SSDEEP

24576:Xd4EpGh6SrO0ggJVqx1lw8opi4ilUrVFpZzwEhkZOJfzCwz+rLKNGX5VRRtcj+pU:GEiPOqJbijSVLbfG0M55VRs+YRli7I

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.svetigeorgije.co.rs
Port:
21
Username:
[email protected]
Password:
4c5H&b2whkD9

Targets

- Target
  
  b4661a2af6703921e7608f403c0c99d2c36e96382eb2a5103f9f110e1f07cd25
- Size
  
  3.3MB
- MD5
  
  ac5987973a9aaf18af3f907822486142
- SHA1
  
  7112407d4894cf50db9ee63dd8737d888be5e99b
- SHA256
  
  b4661a2af6703921e7608f403c0c99d2c36e96382eb2a5103f9f110e1f07cd25
- SHA512
  
  96536129c3e1466b286b336cd1b7abbcbf6e04d24dade250163063cc6b75acdcea200b44e820fd4332e8d0413c27bf57d5806b79a00e41d08eb0e98c57276fb4
- SSDEEP
  
  49152:Ap98Mq2HVhbeiMvZ1HiVbwL2SjWgl2LsJu9nBKfTxIQFTxl3F4CE2/OzvL+4U/bV:AR1hNMiwLPqLsJ04R/bV
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslacollectionkeyloggerspywarestealertrojan

behavioral2

agentteslacollectionkeyloggerspywarestealertrojan