agenttesla

General

Target
9e5178cff05fac46aad92a237db61d7c38c2fa6aadefc5b81a737191c1437330
Size 152KB
Sample240607-b61b1sgf96
SHA256 9e5178cff05fac46aad92a237db61d7c38c2fa6aadefc5b81a737191c1437330
MD5 0c44d9a35ddced69cd6b6ce880333a76
SHA1 da0325504da5906c8b09fc13d734da4d5be2a11f
SHA512 0b4abaa990b2d3b2374ae00d32367935bd9e8e074f616e954adc9118281169b521e6086ff94145dd296ba538f8d424f7337d9617cd816d529e65b61467e88314
SSDEEP 1536:tV8eTqld99CObKBKPcyGNaJK6zonMhLW0/5JpQ5Pc8+2GjVgg0BDbUZlu9gISsRo:v8eTqldEaJK6n/Ic8+2GRgg0BDcn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.mohawatradingco.com
Port
587
Username
[email protected]
Password
mohawatradingco.com
Email to
[email protected]

Targets

- Target
  9e5178cff05fac46aad92a237db61d7c38c2fa6aadefc5b81a737191c1437330
- Size 152KB
- SHA256 9e5178cff05fac46aad92a237db61d7c38c2fa6aadefc5b81a737191c1437330
- MD5 0c44d9a35ddced69cd6b6ce880333a76
- SHA1 da0325504da5906c8b09fc13d734da4d5be2a11f
- SHA512 0b4abaa990b2d3b2374ae00d32367935bd9e8e074f616e954adc9118281169b521e6086ff94145dd296ba538f8d424f7337d9617cd816d529e65b61467e88314
- SSDEEP 1536:tV8eTqld99CObKBKPcyGNaJK6zonMhLW0/5JpQ5Pc8+2GjVgg0BDbUZlu9gISsRo:v8eTqldEaJK6n/Ic8+2GRgg0BDcn
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla execution keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2