agenttesla

General

Target
SecuriteInfo.com.Win32.PWSX-gen.8266.31032.exe
Size 701KB
Sample240809-twydsasfqp
SHA256 f2ac0a7e5be3c2b1df4cc8fa9cd69e057ffc4530622755624638d0d6840ec367
MD5 43e636d182fa2b1ac22d30da3a2097c1
SHA1 9b5f663ee7d4ac97d9d08df06dbc7a33d077601b
SHA512 9cc506abaf7d6a5d760ee91c1d8a505d441759e2bce7ad754b682d49c0bf940d061fdd3ac88a8b3841fc3dc2b1be6f079aec26ffc39b2752c78260b0dec18663
SSDEEP 12288:91keYbGeB3ngo8OvMCF4dUbBuIfd+Vt+12pF1b6SwUle9fiM3aHJRz1hJkASkR:aGCngoNFvBuIfd+Vt+QF56IlIfitH/zB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
phoenixblowers.com
Port
587
Username
[email protected]
Password
Officeback@2022#
Email to
[email protected]

Targets

- Target
  SecuriteInfo.com.Win32.PWSX-gen.8266.31032.exe
- Size 701KB
- SHA256 f2ac0a7e5be3c2b1df4cc8fa9cd69e057ffc4530622755624638d0d6840ec367
- MD5 43e636d182fa2b1ac22d30da3a2097c1
- SHA1 9b5f663ee7d4ac97d9d08df06dbc7a33d077601b
- SHA512 9cc506abaf7d6a5d760ee91c1d8a505d441759e2bce7ad754b682d49c0bf940d061fdd3ac88a8b3841fc3dc2b1be6f079aec26ffc39b2752c78260b0dec18663
- SSDEEP 12288:91keYbGeB3ngo8OvMCF4dUbBuIfd+Vt+12pF1b6SwUle9fiM3aHJRz1hJkASkR:aGCngoNFvBuIfd+Vt+QF56IlIfitH/zB
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla credential_access discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Credentials from Password Stores: Credentials from Web Browsers

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2