agenttesla | f0ad4598add8aedee80ad36b547e44613d1690cc818564d82c18bdeccaeeb90c | Triage

Sharing

General

Target

f0ad4598add8aedee80ad36b547e44613d1690cc818564d82c18bdeccaeeb90c
Size

234KB
Sample

240727-brv4ra1and
MD5

87d241498d5647b80b3ae5f7b9b00e0a
SHA1

b34fead8f3f8afe7fb6e9ff3443ec06f3000ed9f
SHA256

f0ad4598add8aedee80ad36b547e44613d1690cc818564d82c18bdeccaeeb90c
SHA512

7b32ec21dfd1fbe6da1de579033c60c70d707ff73ceb6fb1b1880e059c15d3f8247b0ec30797e0f4fa96690bca11ae6be8a33ca2297f55e4f42b04013b781250
SSDEEP

3072:oRICC2y8xNaoQAOeDxKBgxtfYawLMv05nCyN0xiRG:oRICbooQAOeDxKBgLYHYv1yWw

Score

10^/10

agenttesla credential_access discovery keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot7103128534:AAEX7cqstzGDmw81dLz-shfxzvXALbiavNI/

Targets

- Target
  
  f0ad4598add8aedee80ad36b547e44613d1690cc818564d82c18bdeccaeeb90c
- Size
  
  234KB
- MD5
  
  87d241498d5647b80b3ae5f7b9b00e0a
- SHA1
  
  b34fead8f3f8afe7fb6e9ff3443ec06f3000ed9f
- SHA256
  
  f0ad4598add8aedee80ad36b547e44613d1690cc818564d82c18bdeccaeeb90c
- SHA512
  
  7b32ec21dfd1fbe6da1de579033c60c70d707ff73ceb6fb1b1880e059c15d3f8247b0ec30797e0f4fa96690bca11ae6be8a33ca2297f55e4f42b04013b781250
- SSDEEP
  
  3072:oRICC2y8xNaoQAOeDxKBgxtfYawLMv05nCyN0xiRG:oRICbooQAOeDxKBgLYHYv1yWw
Score

10^/10

agenttesla credential_access discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Credentials in Registry

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

behavioral2

agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan