agenttesla | 5b79bb5c716c9797e048785965be3c3a54a73a587d23d0027130cb31b618e124 | Triage

Sharing

General

Target

5b79bb5c716c9797e048785965be3c3a54a73a587d23d0027130cb31b618e124
Size

812KB
Sample

241017-bgyrwsxckm
MD5

2788e0e233dfa0671c63179549ad16ed
SHA1

d9edf6671d0e7abf960a1c5dc8c6a126ec8f2c23
SHA256

5b79bb5c716c9797e048785965be3c3a54a73a587d23d0027130cb31b618e124
SHA512

359e41da27a9e214d2d08eb8f340a6951a53a717078254cf4889e039c9cbc86e7f159fb2c94fa1f9f49d6f80d2fa667f67f7084d074f6a82726578c8c5f6a6da
SSDEEP

12288:o53yuZG8+De1kIse8LRWjrZCollIoNE8krZu3zvK541r8m:o53yuZGVteKRyjl6ikdCzvy41r

Score

10^/10

agenttesla collection discovery keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.aminhacorretora.com.br
Port:
21
Username:
[email protected]
Password:
_yA=,M5*J?KH

Targets

- Target
  
  5b79bb5c716c9797e048785965be3c3a54a73a587d23d0027130cb31b618e124
- Size
  
  812KB
- MD5
  
  2788e0e233dfa0671c63179549ad16ed
- SHA1
  
  d9edf6671d0e7abf960a1c5dc8c6a126ec8f2c23
- SHA256
  
  5b79bb5c716c9797e048785965be3c3a54a73a587d23d0027130cb31b618e124
- SHA512
  
  359e41da27a9e214d2d08eb8f340a6951a53a717078254cf4889e039c9cbc86e7f159fb2c94fa1f9f49d6f80d2fa667f67f7084d074f6a82726578c8c5f6a6da
- SSDEEP
  
  12288:o53yuZG8+De1kIse8LRWjrZCollIoNE8krZu3zvK541r8m:o53yuZGVteKRyjl6ikdCzvy41r
Score

10^/10

agenttesla collection discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslacollectiondiscoverykeyloggerspywarestealertrojan

behavioral2

agentteslacollectiondiscoverykeyloggerspywarestealertrojan