agenttesla | ab42c6ed1f832ce486853bbb1c01549cf9c718b806797923518d3d4b5f363a65 | Triage

Sharing

General

Target

ab42c6ed1f832ce486853bbb1c01549cf9c718b806797923518d3d4b5f363a65
Size

1.0MB
Sample

240905-yna1qsygla
MD5

e1cadc74a723c43d1005431c4cc6667f
SHA1

5b4570b6164028647ae49097ae4ffa75a579f042
SHA256

ab42c6ed1f832ce486853bbb1c01549cf9c718b806797923518d3d4b5f363a65
SHA512

cf7e993ec6e3887c5e734d32d738589a36d366de05bf1deeff34bfd421957fc1320cbcf81d8120e30384ce9b5fd93db825339aa1afca52890574bd9a2d051240
SSDEEP

24576:cAHnh+eWsN3skA4RV1Hom2KXMmHaonRHvrgxp5:7h+ZkldoPK8YaonuZ

Score

10^/10

agenttesla credential_access discovery keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.albatraparts.com
Port:
587
Username:
[email protected]
Password:
hani1952
Email To:
[email protected]

Targets

- Target
  
  ab42c6ed1f832ce486853bbb1c01549cf9c718b806797923518d3d4b5f363a65
- Size
  
  1.0MB
- MD5
  
  e1cadc74a723c43d1005431c4cc6667f
- SHA1
  
  5b4570b6164028647ae49097ae4ffa75a579f042
- SHA256
  
  ab42c6ed1f832ce486853bbb1c01549cf9c718b806797923518d3d4b5f363a65
- SHA512
  
  cf7e993ec6e3887c5e734d32d738589a36d366de05bf1deeff34bfd421957fc1320cbcf81d8120e30384ce9b5fd93db825339aa1afca52890574bd9a2d051240
- SSDEEP
  
  24576:cAHnh+eWsN3skA4RV1Hom2KXMmHaonRHvrgxp5:7h+ZkldoPK8YaonuZ
Score

10^/10

agenttesla credential_access discovery keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslacredential_accessdiscoverykeyloggerpersistencespywarestealertrojan

behavioral2

agentteslacredential_accessdiscoverykeyloggerpersistencespywarestealertrojan