agenttesla

General

Target

a56bf971cdb4d61c6deac96029e2260d3d93c606dea28e97215fd54a620682a7
Size

675KB
Sample

240522-cqtd7shc9s
MD5

c4e3badc6d39bbdef22f6667752e9a7e
SHA1

02845351022931e91b4ad7797c7781124b173e50
SHA256

a56bf971cdb4d61c6deac96029e2260d3d93c606dea28e97215fd54a620682a7
SHA512

a70d6f05e420b659a7d99d3b7d33e0ebe14d4fa7b56dab6b97daf79707ad3f2cd8ad9b550f85c63c6408ba5e2eb45b58694bba47aa34e2529d457c4dd0adb8b0
SSDEEP

12288:vlYifTHmZeHNHwFjjpr1G8QbnQ/yFBbd5nw3FZtLh3XkR:vmireeNw3EnnkyFxrwa

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
nl9.nlkoddos.com
Port:
587
Username:
[email protected]
Password:
Myname321@
Email To:
[email protected]

Extracted

Credentials

Protocol: smtp
Host:
nl9.nlkoddos.com
Port:
587
Username:
[email protected]
Password:
Myname321@

Targets

- Target
  
  a56bf971cdb4d61c6deac96029e2260d3d93c606dea28e97215fd54a620682a7
- Size
  
  675KB
- MD5
  
  c4e3badc6d39bbdef22f6667752e9a7e
- SHA1
  
  02845351022931e91b4ad7797c7781124b173e50
- SHA256
  
  a56bf971cdb4d61c6deac96029e2260d3d93c606dea28e97215fd54a620682a7
- SHA512
  
  a70d6f05e420b659a7d99d3b7d33e0ebe14d4fa7b56dab6b97daf79707ad3f2cd8ad9b550f85c63c6408ba5e2eb45b58694bba47aa34e2529d457c4dd0adb8b0
- SSDEEP
  
  12288:vlYifTHmZeHNHwFjjpr1G8QbnQ/yFBbd5nw3FZtLh3XkR:vmireeNw3EnnkyFxrwa
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2