agenttesla | 266d27c5127a35ce1beff1de731c147b95e3d954afbb20c93308bacf3ff63dc2 | Triage

Sharing

General

Target

266d27c5127a35ce1beff1de731c147b95e3d954afbb20c93308bacf3ff63dc2
Size

813KB
Sample

241017-bf5ttaxbqk
MD5

d434a55b2bcc180275cee1074574b2b2
SHA1

9dddac47b0c412d3d8ed0b7f284709d9fb0ba800
SHA256

266d27c5127a35ce1beff1de731c147b95e3d954afbb20c93308bacf3ff63dc2
SHA512

df75ee7fcac05792fe3b2f1bf51f8a1eff1c06c6df66da9e708d5c07a93460b39255812517fe0b27cae5e26a2b7935189c725733767187decbe75d85d3512c22
SSDEEP

12288:SSa3yuZG8+De1kIse8LRWjrZCollIoNE8kCZu3FvK541r3NT0:SSa3yuZGVteKRyjl6ikcCFvy41r3N4

Score

10^/10

agenttesla collection discovery keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.aminhacorretora.com.br
Port:
21
Username:
[email protected]
Password:
_yA=,M5*J?KH

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.aminhacorretora.com.br
Port:
21
Username:
[email protected]
Password:
_yA=,M5*J?KH

Targets

- Target
  
  266d27c5127a35ce1beff1de731c147b95e3d954afbb20c93308bacf3ff63dc2
- Size
  
  813KB
- MD5
  
  d434a55b2bcc180275cee1074574b2b2
- SHA1
  
  9dddac47b0c412d3d8ed0b7f284709d9fb0ba800
- SHA256
  
  266d27c5127a35ce1beff1de731c147b95e3d954afbb20c93308bacf3ff63dc2
- SHA512
  
  df75ee7fcac05792fe3b2f1bf51f8a1eff1c06c6df66da9e708d5c07a93460b39255812517fe0b27cae5e26a2b7935189c725733767187decbe75d85d3512c22
- SSDEEP
  
  12288:SSa3yuZG8+De1kIse8LRWjrZCollIoNE8kCZu3FvK541r3NT0:SSa3yuZGVteKRyjl6ikcCFvy41r3N4
Score

10^/10

agenttesla collection discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslacollectiondiscoverykeyloggerspywarestealertrojan

behavioral2

agentteslacollectiondiscoverykeyloggerspywarestealertrojan