agenttesla | 7ee8c32970f34719127d9ed8087396dd00975d2b17186c1b1915385d246cdfd4 | Triage

Sharing

General

Target

51 Electronic Invoicing .pdf.exe
Size

1.0MB
Sample

240521-nv6e4scd84
MD5

5165e5022c628f4d08a5428b1d009dd4
SHA1

2c63ec13ac0d1908065fccd7df99a7f7d0c18e71
SHA256

7ee8c32970f34719127d9ed8087396dd00975d2b17186c1b1915385d246cdfd4
SHA512

3d17b7492fe141a8ed2d2aa10bc0b5e7500d660dce3f06f818f271b098b9e0b250c4068419faea6a051ab708ef0c6b6a186fb7337cfacc04e8f561824adfb019
SSDEEP

24576:0AHnh+eWsN3skA4RV1Hom2KXMmHaUA9ItV1ONS5:Dh+ZkldoPK8YaUA6tVb

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.abanengineering.com
Port:
587
Username:
[email protected]
Password:
Shah@123
Email To:
[email protected]

Targets

- Target
  
  51 Electronic Invoicing .pdf.exe
- Size
  
  1.0MB
- MD5
  
  5165e5022c628f4d08a5428b1d009dd4
- SHA1
  
  2c63ec13ac0d1908065fccd7df99a7f7d0c18e71
- SHA256
  
  7ee8c32970f34719127d9ed8087396dd00975d2b17186c1b1915385d246cdfd4
- SHA512
  
  3d17b7492fe141a8ed2d2aa10bc0b5e7500d660dce3f06f818f271b098b9e0b250c4068419faea6a051ab708ef0c6b6a186fb7337cfacc04e8f561824adfb019
- SSDEEP
  
  24576:0AHnh+eWsN3skA4RV1Hom2KXMmHaUA9ItV1ONS5:Dh+ZkldoPK8YaUA6tVb
Score

10^/10

agenttesla keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslakeyloggerpersistencespywarestealertrojan

behavioral2

agentteslakeyloggerpersistencespywarestealertrojan