agenttesla

General

Target

a08e6eb5abf43b1b82c2cb670e74538eb02fed21a3a63b93cfbfbf8a22707c0d.exe
Size

234KB
Sample

240522-rwdchaed94
MD5

f8a0b524a9bf092127367ab435be80ca
SHA1

1bd52ef830a42a9bd5be0c2fec999fe86e55ebe7
SHA256

a08e6eb5abf43b1b82c2cb670e74538eb02fed21a3a63b93cfbfbf8a22707c0d
SHA512

1dc502faa615b30bc600e142ef8147d3a9d41eccb82142995b0ad9e7a57430789ccbaba89111e322b9d1b3432c9161c4f1436b7833c5690fdcfa3ad9f71540b5
SSDEEP

3072:uBAvjPLfl7zHvs0bYQvOAs34mM25rvP1tQJ:uBAvjPLfRzHvs0bYnCmMW31K

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
aYl@txL3
Email To:
[email protected]

Extracted

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
aYl@txL3

Targets

- Target
  
  a08e6eb5abf43b1b82c2cb670e74538eb02fed21a3a63b93cfbfbf8a22707c0d.exe
- Size
  
  234KB
- MD5
  
  f8a0b524a9bf092127367ab435be80ca
- SHA1
  
  1bd52ef830a42a9bd5be0c2fec999fe86e55ebe7
- SHA256
  
  a08e6eb5abf43b1b82c2cb670e74538eb02fed21a3a63b93cfbfbf8a22707c0d
- SHA512
  
  1dc502faa615b30bc600e142ef8147d3a9d41eccb82142995b0ad9e7a57430789ccbaba89111e322b9d1b3432c9161c4f1436b7833c5690fdcfa3ad9f71540b5
- SSDEEP
  
  3072:uBAvjPLfl7zHvs0bYQvOAs34mM25rvP1tQJ:uBAvjPLfRzHvs0bYnCmMW31K
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

Lateral Movement

Collection

Data from Local System

4

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2