agenttesla | 2534507243f92dc2b0a2bc4b0787d63461a4eaf295b68f1f41a69163120d9fb8 | Triage

Sharing

General

Target

2534507243f92dc2b0a2bc4b0787d63461a4eaf295b68f1f41a69163120d9fb8
Size

815KB
Sample

241017-bf7neatdmc
MD5

1262b381609193bd0514fed812173719
SHA1

c8340cfae752bca4fa76b9d83e4f29c061b90e8b
SHA256

2534507243f92dc2b0a2bc4b0787d63461a4eaf295b68f1f41a69163120d9fb8
SHA512

ad53164041228d24b529eeaeafa1555a958dd2647ec4136794c539939a2043595c27761cd96115c1ce49eb51bdba3abb8a9a5d7fdb5f96cb7cd7cb9c975a91c2
SSDEEP

12288:sS2s3yuZG8+De1kIse8LRWjrZCollIoNE8kgZu3KvK541rt:Us3yuZGVteKRyjl6ikyCKvy41rt

Score

10^/10

agenttesla collection discovery keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.aminhacorretora.com.br
Port:
21
Username:
[email protected]
Password:
_yA=,M5*J?KH

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.aminhacorretora.com.br
Port:
21
Username:
[email protected]
Password:
_yA=,M5*J?KH

Targets

- Target
  
  2534507243f92dc2b0a2bc4b0787d63461a4eaf295b68f1f41a69163120d9fb8
- Size
  
  815KB
- MD5
  
  1262b381609193bd0514fed812173719
- SHA1
  
  c8340cfae752bca4fa76b9d83e4f29c061b90e8b
- SHA256
  
  2534507243f92dc2b0a2bc4b0787d63461a4eaf295b68f1f41a69163120d9fb8
- SHA512
  
  ad53164041228d24b529eeaeafa1555a958dd2647ec4136794c539939a2043595c27761cd96115c1ce49eb51bdba3abb8a9a5d7fdb5f96cb7cd7cb9c975a91c2
- SSDEEP
  
  12288:sS2s3yuZG8+De1kIse8LRWjrZCollIoNE8kgZu3KvK541rt:Us3yuZGVteKRyjl6ikyCKvy41rt
Score

10^/10

agenttesla collection discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslacollectiondiscoverykeyloggerspywarestealertrojan

behavioral2

agentteslacollectiondiscoverykeyloggerspywarestealertrojan