agenttesla

General

Target

6a00f96910b958ad9e5c3394a2b31999_JaffaCakes118
Size

724KB
Sample

240523-gz716sgb4s
MD5

6a00f96910b958ad9e5c3394a2b31999
SHA1

927abdb2d7510b924da27ed47e00ab916ed3bd22
SHA256

ad9ea09ec4170fbca565125a45e530ca8f6105b4d5d48ec3a5c729af98932499
SHA512

9cf2531b5d7a7388449e0c91d00aeb48d505d5bc12693ba488644af1162782e31e6208338e8962641981db11912828d30a5d4694fcaaa66016c03ecb90a699cf
SSDEEP

12288:+SQycOwtOTKhshQ9tDxMW6yuZWLDAyiiTB/1uVSrDmA3zSKVHbQ63qm2p0Jl:tc6TKOhQ9tWyuZWfA0BUVSOA+KV7Q63z

Score

10^/10

Malware Config

Targets

- Target
  
  6a00f96910b958ad9e5c3394a2b31999_JaffaCakes118
- Size
  
  724KB
- MD5
  
  6a00f96910b958ad9e5c3394a2b31999
- SHA1
  
  927abdb2d7510b924da27ed47e00ab916ed3bd22
- SHA256
  
  ad9ea09ec4170fbca565125a45e530ca8f6105b4d5d48ec3a5c729af98932499
- SHA512
  
  9cf2531b5d7a7388449e0c91d00aeb48d505d5bc12693ba488644af1162782e31e6208338e8962641981db11912828d30a5d4694fcaaa66016c03ecb90a699cf
- SSDEEP
  
  12288:+SQycOwtOTKhshQ9tDxMW6yuZWLDAyiiTB/1uVSrDmA3zSKVHbQ63qm2p0Jl:tc6TKOhQ9tWyuZWfA0BUVSOA+KV7Q63z
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Targets

AgentTesla payload

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2