agenttesla

General

Target

MNPOk988.exe
Size

184KB
Sample

240809-hp1psa1fne
MD5

2e6ef53a393d2f2b715897f0bbd78490
SHA1

b594ab5fdd7d5cd325bf3f753a676606d92efc9c
SHA256

afb8e5221438fe28f3012fbb11d085f56e3b033a68a544dd0ac160bef136ed73
SHA512

2a00acf5a9264ceae5972fe4063a9a312088f06849cb720eb1ad9558b0fda6ceff97188268e5eaec3d9521b34be59b890e57d5c18027035ae4cb299afcd0357a
SSDEEP

3072:TgvEVXBU+uuE5MP0ncgFjPEleG89Lj4QAAncZDi2hyCjMX/7GmCMY7pdkz:T0sRUbZ5Mz0jcI9P4QWOEMi

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.transarbe.com
Port:
587
Username:
[email protected]
Password:
EkH1awjsCu
Email To:
[email protected]

Extracted

Credentials

Protocol: smtp
Host:
mail.transarbe.com
Port:
587
Username:
[email protected]
Password:
EkH1awjsCu

Targets

- Target
  
  MNPOk988.exe
- Size
  
  184KB
- MD5
  
  2e6ef53a393d2f2b715897f0bbd78490
- SHA1
  
  b594ab5fdd7d5cd325bf3f753a676606d92efc9c
- SHA256
  
  afb8e5221438fe28f3012fbb11d085f56e3b033a68a544dd0ac160bef136ed73
- SHA512
  
  2a00acf5a9264ceae5972fe4063a9a312088f06849cb720eb1ad9558b0fda6ceff97188268e5eaec3d9521b34be59b890e57d5c18027035ae4cb299afcd0357a
- SSDEEP
  
  3072:TgvEVXBU+uuE5MP0ncgFjPEleG89Lj4QAAncZDi2hyCjMX/7GmCMY7pdkz:T0sRUbZ5Mz0jcI9P4QWOEMi
Score

10^/10

agenttesla credential_access discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Credentials from Password Stores: Credentials from Web Browsers

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2