agenttesla

General

Target

22082024104021082024NuestrareferenciaNoCN20240080641.zip
Size

704KB
Sample

240822-n73jzsyejr
MD5

675e470495e875ee9b08cf73e3f4e1fa
SHA1

09a8b6604a26e60961ad0f4af734c36680abc780
SHA256

0bd6981040d5b95fdfa5a05bf746044ee6b0e363f5fb0c83f34adca3f55e6484
SHA512

817a1d51ef8cfa611ca6aa451778c6c3d3e4932220cb7088e8ca85d58526d8d817cecf5c2fda1279e1866a7472c7251c9a1f8873df75376134d42ec77a2c8cea
SSDEEP

12288:O4MxqVKk/oq4NgE6PrG2aL/9anVOscYIs920pyhg3Xphu77iwVlC:O4CBeE96PiLwV5H99p/h3aI

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.claresbout.com
Port:
587
Username:
[email protected]
Password:
fahaF^V7
Email To:
[email protected]

Targets

- Target
  
  maxxy.exe
- Size
  
  1.1MB
- MD5
  
  2aa8b8c86b2f39bcebe47298adbc5083
- SHA1
  
  363c7f9c9dbe5e21e46ec2f78cb13f6d1795c2da
- SHA256
  
  87d10858a265f087715c25d4682dc91fa31a3bc54cda9c7bd1c563ad7b6a0c1c
- SHA512
  
  d6518eb6523ad1a6abd930353dd880eae4c494dc90707141acb827194e4474bbe5e8c9876471541c3193964a88d268241f8788157152f9d31fdab96a069f9f22
- SSDEEP
  
  24576:9qDEvCTbMWu7rQYlBQcBiT6rprG8aGd9L5f2:9TvC/MTQYxsWR7aGHL
Score

10^/10

agenttesla credential_access discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Credentials from Password Stores: Credentials from Web Browsers

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2