agenttesla | f09814715a247c4a93532cc3aa8ecf108c55494a6b32cbe7dfb424792d1ad33e | Triage

Sharing

General

Target

f09814715a247c4a93532cc3aa8ecf108c55494a6b32cbe7dfb424792d1ad33e
Size

1.4MB
Sample

250114-cdeehstkey
MD5

633134941eda076fd3c6f24770b168d1
SHA1

a8241a8b1060a4f645f080a3ede8be6a14d35862
SHA256

f09814715a247c4a93532cc3aa8ecf108c55494a6b32cbe7dfb424792d1ad33e
SHA512

2695dac5d55300e1e2f5cc9c0506de27281010f9fd7a36b3a344436330e517a02de79b2fd743cc13c51560d789f2167b9ff89069139d8fa1aaf394ce6000ff8d
SSDEEP

24576:lanmoB/IJHXop81q1v1RIAhjLoamMiX4lNmZg0YxegPbUIDPP:laVImpVzjLoyEkmZ9Y14

Score

10^/10

agenttesla collection credential_access discovery keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
[email protected]
Password:
41k2c4yfVG

Extracted

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
[email protected]
Password:
41k2c4yfVG

Targets

- Target
  
  f09814715a247c4a93532cc3aa8ecf108c55494a6b32cbe7dfb424792d1ad33e
- Size
  
  1.4MB
- MD5
  
  633134941eda076fd3c6f24770b168d1
- SHA1
  
  a8241a8b1060a4f645f080a3ede8be6a14d35862
- SHA256
  
  f09814715a247c4a93532cc3aa8ecf108c55494a6b32cbe7dfb424792d1ad33e
- SHA512
  
  2695dac5d55300e1e2f5cc9c0506de27281010f9fd7a36b3a344436330e517a02de79b2fd743cc13c51560d789f2167b9ff89069139d8fa1aaf394ce6000ff8d
- SSDEEP
  
  24576:lanmoB/IJHXop81q1v1RIAhjLoamMiX4lNmZg0YxegPbUIDPP:laVImpVzjLoyEkmZ9Y14
Score

10^/10

agenttesla collection credential_access discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslacollectioncredential_accessdiscoverykeyloggerspywarestealertrojan

behavioral2

agentteslacollectioncredential_accessdiscoverykeyloggerspywarestealertrojan