agenttesla | c84693b4a478de08b400a4acef57303dbf75d4d7800ed0c44a478ed4ee967ca7 | Triage

Sharing

General

Target

c84693b4a478de08b400a4acef57303dbf75d4d7800ed0c44a478ed4ee967ca7
Size

1.5MB
Sample

250114-b812bstjfv
MD5

e7c0cec033495b350b70271de9a127c1
SHA1

9759f386b7721a10b84212ee4ec4b91c0e3b1ba6
SHA256

c84693b4a478de08b400a4acef57303dbf75d4d7800ed0c44a478ed4ee967ca7
SHA512

4652ed69f047a585017ce710ecd044346e3ac4d7cb159adba9246a2520fbad0f7395d83f0ebe0b4148b140775731a2ba192f7f0707b2add9d90072175c8b49d6
SSDEEP

24576:z1/HEFP4BEb2fxuMq0fqv1RIAhjLoamMiX4lNmZg0YxegPbUIDPP:zVqSkmxu56ijLoyEkmZ9Y14

Score

10^/10

agenttesla collection credential_access discovery keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.swarnford.in
Port:
587
Username:
[email protected]
Password:
F!go#456

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.swarnford.in
Port:
587
Username:
[email protected]
Password:
F!go#456
Email To:
[email protected]

Targets

- Target
  
  c84693b4a478de08b400a4acef57303dbf75d4d7800ed0c44a478ed4ee967ca7
- Size
  
  1.5MB
- MD5
  
  e7c0cec033495b350b70271de9a127c1
- SHA1
  
  9759f386b7721a10b84212ee4ec4b91c0e3b1ba6
- SHA256
  
  c84693b4a478de08b400a4acef57303dbf75d4d7800ed0c44a478ed4ee967ca7
- SHA512
  
  4652ed69f047a585017ce710ecd044346e3ac4d7cb159adba9246a2520fbad0f7395d83f0ebe0b4148b140775731a2ba192f7f0707b2add9d90072175c8b49d6
- SSDEEP
  
  24576:z1/HEFP4BEb2fxuMq0fqv1RIAhjLoamMiX4lNmZg0YxegPbUIDPP:zVqSkmxu56ijLoyEkmZ9Y14
Score

10^/10

agenttesla collection credential_access discovery keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslacollectioncredential_accessdiscoverykeyloggerpersistencespywarestealertrojan

behavioral2

agentteslacollectioncredential_accessdiscoverykeyloggerpersistencespywarestealertrojan