agenttesla

General

Target

0bee1da009540c5b7eebaba5d134b8aa5eff06aab526c58cc332e843cde56fd5.exe
Size

1.1MB
Sample

240904-rb5ags1frk
MD5

c4d66adae73f917088c4312d1a20f0b7
SHA1

4fd8bdce2edf247641c31b3420a321fa99b83890
SHA256

0bee1da009540c5b7eebaba5d134b8aa5eff06aab526c58cc332e843cde56fd5
SHA512

90feaac35f587d2ff1be50654fe681d11457edf6d9873e6eae1567e79b7e71316b0c38a07ae2c7c22eaab689252973c9a659fde90ed3c9ab9e8ab79a43c6346f
SSDEEP

24576:FqDEvCTbMWu7rQYlBQcBiT6rprG8a1DQi7LlJE:FTvC/MTQYxsWR7a1/77

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.claresbout.com
Port:
587
Username:
[email protected]
Password:
fahaF^V7
Email To:
[email protected]

Targets

- Target
  
  0bee1da009540c5b7eebaba5d134b8aa5eff06aab526c58cc332e843cde56fd5.exe
- Size
  
  1.1MB
- MD5
  
  c4d66adae73f917088c4312d1a20f0b7
- SHA1
  
  4fd8bdce2edf247641c31b3420a321fa99b83890
- SHA256
  
  0bee1da009540c5b7eebaba5d134b8aa5eff06aab526c58cc332e843cde56fd5
- SHA512
  
  90feaac35f587d2ff1be50654fe681d11457edf6d9873e6eae1567e79b7e71316b0c38a07ae2c7c22eaab689252973c9a659fde90ed3c9ab9e8ab79a43c6346f
- SSDEEP
  
  24576:FqDEvCTbMWu7rQYlBQcBiT6rprG8a1DQi7LlJE:FTvC/MTQYxsWR7a1/77
Score

10^/10

agenttesla credential_access discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Credentials from Password Stores: Credentials from Web Browsers

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2