agenttesla

General

Target

534ab39c1a98a84e8d5a2ababb73c161e46df4f3c9c48e77a01d9a8b0fb82256
Size

646KB
Sample

240523-cjqdzaab23
MD5

9210d14ee4e82e98d68e4277a88b3a48
SHA1

0cf2a71046a2cbb4e493f0dac0e8d11164908a79
SHA256

534ab39c1a98a84e8d5a2ababb73c161e46df4f3c9c48e77a01d9a8b0fb82256
SHA512

e8c17d48fc4b77035d8534782c6f7716354711d8b1a2bf0e6c7f36e261ff0ba0689ee9ff7e888fb043dde6f387b81c1b189408ec7961f2c72fd6054ffb40f68d
SSDEEP

12288:+6sLntED0NMrI4Ice8JTjTOB6vRvscnX72NgTALUYvKgdMUHlkZg:+6sztEUM3te84gfXogMolMXHqG

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.ipr-co.org
Port:
587
Username:
[email protected]
Password:
IPRco@100102@
Email To:
[email protected]

Extracted

Credentials

Protocol: smtp
Host:
mail.ipr-co.org
Port:
587
Username:
[email protected]
Password:
IPRco@100102@

Targets

- Target
  
  New order 21052024.exe
- Size
  
  669KB
- MD5
  
  3722bab91535870e9e4cf25acef04f33
- SHA1
  
  14ed1edc1f75e918f3fe1abf721296a7c5cd3c17
- SHA256
  
  e511acb6ee6297e004ee5672a58d408e3c7e2fefaa34e067ef3b6a7ed90f306f
- SHA512
  
  f25a1e4909a457c836db628b064c658076833999c8ea83b6f1781072c7356c00cc73d86152acbaeb96202c9e2e14603d8bb75cce970a7f80edd54714605dfa5e
- SSDEEP
  
  12288:rXJQEz0nMPImIc6+JTP1O9avRlQc9XJ2Nyp8LYYnSgd+sLlYZE:uEOMPt6+kA5B+ySUhMHLKG
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

Lateral Movement

Collection

Data from Local System

4

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2