agenttesla

General

Target
2534507243f92dc2b0a2bc4b0787d63461a4eaf295b68f1f41a69163120d9fb8
Size 815KB
Sample241017-bf7neatdmc
SHA256 2534507243f92dc2b0a2bc4b0787d63461a4eaf295b68f1f41a69163120d9fb8
MD5 1262b381609193bd0514fed812173719
SHA1 c8340cfae752bca4fa76b9d83e4f29c061b90e8b
SHA512 ad53164041228d24b529eeaeafa1555a958dd2647ec4136794c539939a2043595c27761cd96115c1ce49eb51bdba3abb8a9a5d7fdb5f96cb7cd7cb9c975a91c2
SSDEEP 12288:sS2s3yuZG8+De1kIse8LRWjrZCollIoNE8kgZu3KvK541rt:Us3yuZGVteKRyjl6ikyCKvy41rt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Credentials

Protocol
ftp
Host
ftp.aminhacorretora.com.br
Port
21
Username
[email protected]
Password
_yA=,M5*J?KH

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.aminhacorretora.com.br
Port
21
Username
[email protected]
Password
_yA=,M5*J?KH

Targets

- Target
  2534507243f92dc2b0a2bc4b0787d63461a4eaf295b68f1f41a69163120d9fb8
- Size 815KB
- SHA256 2534507243f92dc2b0a2bc4b0787d63461a4eaf295b68f1f41a69163120d9fb8
- MD5 1262b381609193bd0514fed812173719
- SHA1 c8340cfae752bca4fa76b9d83e4f29c061b90e8b
- SHA512 ad53164041228d24b529eeaeafa1555a958dd2647ec4136794c539939a2043595c27761cd96115c1ce49eb51bdba3abb8a9a5d7fdb5f96cb7cd7cb9c975a91c2
- SSDEEP 12288:sS2s3yuZG8+De1kIse8LRWjrZCollIoNE8kgZu3KvK541rt:Us3yuZGVteKRyjl6ikyCKvy41rt
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla collection discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2