agenttesla | 73a0e45c8cd2fcd49f0a3602aec912486610dddca32dc6f879c2d90660be1931 | Triage

Sharing

General

Target

VBCNXNJGFJHFD9873487943.exe
Size

309KB
Sample

240910-3wv34a1enr
MD5

0259d1aa5bf063769f36e5056e554021
SHA1

b4943803c47fa2284c3d30c9e75feefe8a26c04f
SHA256

73a0e45c8cd2fcd49f0a3602aec912486610dddca32dc6f879c2d90660be1931
SHA512

4147998a187e2f8032f123c17ec4a85224b9ba2117ae69f9fc5416eccbac3c70df35ea3e6ed51e6ccd2f402f528a21acab8bb88905b71c19244987a2b43ba836
SSDEEP

3072:wrJxi2KLomWHzmYwKL3RId2zQx/V/iwCm0owzZ0z1GTohLXKHrW37X1Hq:wrJxjfHzIKL6Kw6oQ41GkhLXH71Hq

Score

10^/10

agenttesla collection credential_access discovery keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.botswlogistics.com
Port:
587
Username:
[email protected]
Password:
*(QSTCj8

Targets

- Target
  
  VBCNXNJGFJHFD9873487943.exe
- Size
  
  309KB
- MD5
  
  0259d1aa5bf063769f36e5056e554021
- SHA1
  
  b4943803c47fa2284c3d30c9e75feefe8a26c04f
- SHA256
  
  73a0e45c8cd2fcd49f0a3602aec912486610dddca32dc6f879c2d90660be1931
- SHA512
  
  4147998a187e2f8032f123c17ec4a85224b9ba2117ae69f9fc5416eccbac3c70df35ea3e6ed51e6ccd2f402f528a21acab8bb88905b71c19244987a2b43ba836
- SSDEEP
  
  3072:wrJxi2KLomWHzmYwKL3RId2zQx/V/iwCm0owzZ0z1GTohLXKHrW37X1Hq:wrJxjfHzIKL6Kw6oQ41GkhLXH71Hq
Score

10^/10

agenttesla collection credential_access discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslacollectioncredential_accessdiscoverykeyloggerspywarestealertrojan