agenttesla | 6050d3cacd8e928029dabec97d6584336462f26d2439e26fb4f4fd52dc26f8a0 | Triage

Sharing

General

Target

6050d3cacd8e928029dabec97d6584336462f26d2439e26fb4f4fd52dc26f8a0
Size

728KB
Sample

240917-g1pk8aycjg
MD5

d28662586708ec3dd64627b5a0b37aeb
SHA1

d15b924141703af4c2fd87b8cd2950b817e1c4f6
SHA256

6050d3cacd8e928029dabec97d6584336462f26d2439e26fb4f4fd52dc26f8a0
SHA512

49ac76acb95ee4e56c11bce8682ee4e47b4972a05af778ee90239f808ef3451be530da10f21348795dbbfdf65884fa31140e6924273030ea606819c3833ab4b6
SSDEEP

12288:o+BnbU7Oml2v/hmHNWTCEwWk8kXeRZaSvHUHJ2uX5REOWk4Tw9HEgXqn8OrsP49B:3BbUimlGhmHNIwWk8kXeTNvHU8O5RIkG

Score

10^/10

agenttesla credential_access discovery keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.flujoauditorias.cl
Port:
587
Username:
[email protected]
Password:
l;0jGu7J;z_a

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.flujoauditorias.cl
Port:
587
Username:
[email protected]
Password:
l;0jGu7J;z_a
Email To:
[email protected]

Targets

- Target
  
  3db464cfb18f44f0bd814e59789a76363c0db090afd595add448f8ca802284e2.exe
- Size
  
  77.0MB
- MD5
  
  a2eb0cef8229b46e9b9a326289f9b25a
- SHA1
  
  ac18afedea384ff1fa3294c19fb05e20bb13966b
- SHA256
  
  3db464cfb18f44f0bd814e59789a76363c0db090afd595add448f8ca802284e2
- SHA512
  
  067f218450301f1d4b40214a42a9b85105d3c528d7056a335e043f44e756622bc1b6345a4135ebcc182516ff62414af3c73747563c5b95c8af713e0bf5a3fcc3
- SSDEEP
  
  24576:e4lavt0LkLL9IMixoEgea+rsiDPP/q9MmCS:Jkwkn9IMHea+zDPaPCS
Score

10^/10

agenttesla credential_access discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

behavioral2

agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan