agenttesla

General

Target
7b044d66c7fcbc3d3bf6f5d52e96d3b2.rtf
Size 4.1MB
Sample240524-fs5f2aef38
SHA256 9998ef5f4ea72ae55f9f033b6aa7c21e5e3461ddd69e90a6525042ff6daab653
MD5 7b044d66c7fcbc3d3bf6f5d52e96d3b2
SHA1 f671b1d17948e20794bcd209d8ea1c32b1074155
SHA512 b4f1589734e848061bd6680553c5f5cd625533133421681a561980d94f6d64b833920ef055961bb9719e47e78cbf86e3b1c62e41b8fac4044ccb8529aed92018
SSDEEP 24576:+nLjMle4Ywg76KhKdRukZV+Sc7N4angyRulXC1rfw8BVWXNY0nVJqTsocGmShjy2:y
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.worlorderbillions.top
Port
587
Username
[email protected]
Password
vqpF.#;cCodu
Email to
[email protected]

Targets

- Target
  7b044d66c7fcbc3d3bf6f5d52e96d3b2.rtf
- Size 4.1MB
- SHA256 9998ef5f4ea72ae55f9f033b6aa7c21e5e3461ddd69e90a6525042ff6daab653
- MD5 7b044d66c7fcbc3d3bf6f5d52e96d3b2
- SHA1 f671b1d17948e20794bcd209d8ea1c32b1074155
- SHA512 b4f1589734e848061bd6680553c5f5cd625533133421681a561980d94f6d64b833920ef055961bb9719e47e78cbf86e3b1c62e41b8fac4044ccb8529aed92018
- SSDEEP 24576:+nLjMle4Ywg76KhKdRukZV+Sc7N4angyRulXC1rfw8BVWXNY0nVJqTsocGmShjy2:y
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Exploitation for Client Execution

1

T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

AutoIT Executable

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2