agenttesla

General

Target
adfd936c557a4e3ff5507929d321bcf03a5ecd1b05dbafb442f91bd480ee9f70
Size 817KB
Sample241020-bha28azelg
SHA256 adfd936c557a4e3ff5507929d321bcf03a5ecd1b05dbafb442f91bd480ee9f70
MD5 673fc8d5bfdef7cc05c8809712aa7017
SHA1 6739565ee0637387368b0399cbae74b5b1c562ee
SHA512 2ee314735e7c6cb52c0bec169c9e651637ca46a1e3a35edbca9d4a4af218dcabe98ee947d0acd38251c7def0396c3c2d6cfd1acf754d57978380e12ee44b278d
SSDEEP 12288:qw3yuZG8+De1kIse8LRWjrZCollIoNE8k+Zu3MvK541r:qw3yuZGVteKRyjl6ikICMvy41r
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Credentials

Protocol
ftp
Host
ftp.aminhacorretora.com.br
Port
21
Username
[email protected]
Password
_yA=,M5*J?KH

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.aminhacorretora.com.br
Port
21
Username
[email protected]
Password
_yA=,M5*J?KH

Targets

- Target
  adfd936c557a4e3ff5507929d321bcf03a5ecd1b05dbafb442f91bd480ee9f70
- Size 817KB
- SHA256 adfd936c557a4e3ff5507929d321bcf03a5ecd1b05dbafb442f91bd480ee9f70
- MD5 673fc8d5bfdef7cc05c8809712aa7017
- SHA1 6739565ee0637387368b0399cbae74b5b1c562ee
- SHA512 2ee314735e7c6cb52c0bec169c9e651637ca46a1e3a35edbca9d4a4af218dcabe98ee947d0acd38251c7def0396c3c2d6cfd1acf754d57978380e12ee44b278d
- SSDEEP 12288:qw3yuZG8+De1kIse8LRWjrZCollIoNE8k+Zu3MvK541r:qw3yuZGVteKRyjl6ikICMvy41r
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla collection discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2