agenttesla

General

Target

Pagamento5177126576172QADYUETYU675.7z
Size

562KB
Sample

240830-vp2nasvflh
MD5

7ad7af1f62a64a626e80877caaeb7775
SHA1

3a00e79c0b1a37a5e2a63e3f1c98e3cf77fc4d1a
SHA256

6f1fc9926700e6543b41a7d5525fbcc273c5d81756ed2209b04cc22c74f95f94
SHA512

565af614781cf81bdcee737bd9ac51e60c5d7a1479129951f0d3ae7dce17c99838a6cbdac03628b0139b72e1982e4c97c4c7c1892c8b084c611820a1e8d8a628
SSDEEP

12288:/hC2yRQHjazvaxt6xIpXK96bTWs8mgh5ZdaVXa9XVHy:fQCoaxsx4WdDhrmIXZy

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
cp8nl.hyperhost.ua
Port:
587
Username:
[email protected]
Password:
cy+G_(979n9N
Email To:
[email protected]

Targets

- Target
  
  Pagamento_5177126576172_QADYUETYU675.exe
- Size
  
  588KB
- MD5
  
  d797600296ddbed4497725579d814b7e
- SHA1
  
  54b22078651dcee13472858d706f886a34678b2e
- SHA256
  
  c25a6673a24d169de1bb399d226c12cdc666e0fa534149fc9fa7896ee61d406f
- SHA512
  
  f3f9a54bc4da8c19434bf79a494736c16e4bd0cd539cdddd96742dc8bbd569dde7d51e6daca8ae13386e1a7f02efffc81dd713943917bfa107f66bf8c9d6e226
- SSDEEP
  
  12288:NYV6MorX7qzuC3QHO9FQVHPF51jgcQTimghLdJ0BNajn5:iBXu9HGaVHNhdUun5
Score

10^/10

agenttesla credential_access discovery keylogger spyware stealer trojan upx
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Credentials from Password Stores: Credentials from Web Browsers

UPX packed file

AutoIT Executable

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2