agenttesla

General

Target
1719563345e26e65224caa7856e1dbefb47fea82365877084939cf3d196b299dfd2558b45a338.dat-decoded.exe
Size 238KB
Sample240628-kd568szelh
SHA256 a9bba02b96d42694417f39596c58112f086b63160d2bd5ff4beef616fb130bb2
MD5 e0659414477aceed1bd5ef7c92dc6b7b
SHA1 df1045306471a6b392cce2f28bfd4efdae6dd31b
SHA512 db13b348fcd04d201d0dfb8499d65a1b47e333931bf27146cd2472ed062bf61faf278a9cbbb1f5f3d2f366856d61fc8471f91374b174a08789d6423f7fad0a45
SSDEEP 3072:BhGIm6GyWP/rUcJhwyyyyyyyyyyyyyyyyyyyyy1yyyyyyyyyyyy9yyyybe4VGDmH:BNm6GyWP/rRdBG6SOqeV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.lampadari.gr
Port
21
Username
[email protected]
Password
P8P[uVeJU=vh

Extracted

Credentials

Protocol
ftp
Host
ftp.lampadari.gr
Port
21
Username
[email protected]
Password
P8P[uVeJU=vh

Targets

- Target
  1719563345e26e65224caa7856e1dbefb47fea82365877084939cf3d196b299dfd2558b45a338.dat-decoded.exe
- Size 238KB
- SHA256 a9bba02b96d42694417f39596c58112f086b63160d2bd5ff4beef616fb130bb2
- MD5 e0659414477aceed1bd5ef7c92dc6b7b
- SHA1 df1045306471a6b392cce2f28bfd4efdae6dd31b
- SHA512 db13b348fcd04d201d0dfb8499d65a1b47e333931bf27146cd2472ed062bf61faf278a9cbbb1f5f3d2f366856d61fc8471f91374b174a08789d6423f7fad0a45
- SSDEEP 3072:BhGIm6GyWP/rUcJhwyyyyyyyyyyyyyyyyyyyyy1yyyyyyyyyyyy9yyyybe4VGDmH:BNm6GyWP/rRdBG6SOqeV
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Looks up external IP address via web service

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2