agenttesla

General

Target

TÜBİTAK SAGE TEKLİF TALEP VE FİYAT TEKLİFİ ‮s؜x؜l؜x؜.zip
Size

1.0MB
Sample

240523-s22gysga83
MD5

0d28604cfa4d6b2faa60d68c7a87d28a
SHA1

7cd251b4e904fa7be3082cdf1cf54d5c77656ba7
SHA256

5571ca6a63818c2d61a05941601a2b1f689f37ec9feb53fea5bf5401d49467a3
SHA512

a2b90206c3a6a990b62c88c652250eb1e192916101666e1f312694a5c58989ed982e58500bbd46933f5bfb291f7032c626227662a63a4283ee590d3f7a810343
SSDEEP

12288:ddbuHpxyY28OmC2M5apu9wiP0QmTwqBGV8shQmDfPR0nKfncv/NjSoSIqQUv60hm:O3K/l0rIRB0Fv//F7KK

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
cp8nl.hyperhost.ua
Port:
587
Username:
[email protected]
Password:
7213575aceACE@#$
Email To:
[email protected]

Targets

- Target
  
  TÜBİTAK SAGE TEKLİF TALEP VE FİYAT TEKLİFİ ‮s؜x؜l؜x؜..exe
- Size
  
  2.0MB
- MD5
  
  456442e5615445a54f15eae38140c50a
- SHA1
  
  f81074ce9855601a33b97fb357fbee1bbdd7fcf6
- SHA256
  
  0eca094ac422e8d7b0b58532b5a1fb7a59b4cc6cb6bbe1ec49259ebf10522ae5
- SHA512
  
  b69f617e0deb48af12f230dcf016211f94eea612f364357d84e96499f61b1bdc028cca43bbfa7f8f169b2645f6f6d6f243671e4c10ab2080f9c5896b45bc8ed0
- SSDEEP
  
  24576:oynjN3fi9dEoZR814OEQjls30eTFxmT4i8eMOq52jOXuq01dKqOFWYuO:ZjN3CdJ81nEQhs30e1uqsrOFA
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

Lateral Movement

Collection

Data from Local System

4

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2