agenttesla

General

Target
3fb1255c6fc904518978ece4e7bce0cd.bin
Size 706KB
Sample240613-bvhmtsygra
SHA256 93d71679dfa8b20bfd4fef5e63cc905e6c5c69fe6457f4984e2fe72ec132775b
MD5 2de8f8584710f7022e1dacf837f5fc7b
SHA1 410f705c45572af0c2a141a4e917d19fcc1d2bec
SHA512 75222857c1f1c2b146668ba1113d2ea4600c071422af0cb08541f45f8d9f898b0ed9bec1933d869fe04afa563563ae66033b614d5d441045bef2b5ccdea1da51
SSDEEP 12288:88jKIrkUGzVS/lZinECZ5hSYh5UYhiu8QBI5OtMV74eawxfaCkxTjb9tOOJFS2p3:JKuKVETjlZJUBI5Otq4e7xYxT/9Y6p2y
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.normagroup.com.tr
Port
21
Username
[email protected]
Password
ab+LNvim5PAo

Targets

- Target
  9d33d6e6f5c8d96980bb2774d72d8f2a8dfe3a29674b69f125ffb03bbcac6068.exe
- Size 850KB
- SHA256 9d33d6e6f5c8d96980bb2774d72d8f2a8dfe3a29674b69f125ffb03bbcac6068
- MD5 3fb1255c6fc904518978ece4e7bce0cd
- SHA1 f84bf2121460553535095caede084fcd468d2517
- SHA512 6a64628308dd1c75761386e9d6b5fe11326b8204ecbe5045390e2fedcaf8c12ea983ad74b3908d7e4973de8d6e26ebcb045d901ccda52bb50d901b58a35caeba
- SSDEEP 24576:7g61jjk0LAta9APDIYLVmH5ocl7acZOEJ:C9xGGINZOE
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

Lateral Movement

Collection

Data from Local System

4

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2