agenttesla

General

Target
eca76bae7cf6ffdfef6269b5eae8bca702663e3c2b7f7aca6b9d4d194276acca.exe
Size 1.8MB
Sample250310-nkj45aspx8
SHA256 eca76bae7cf6ffdfef6269b5eae8bca702663e3c2b7f7aca6b9d4d194276acca
MD5 cf4379cf7675fc254a58b06862e47850
SHA1 c08cc4c7c7677b5747e6754de482d3c0869d9d9a
SHA512 ea615f2a34a7e517f8f22ea74660262cc6b3d430088abb053aeb201cd95c9be6d912fd0b2c6f55b3b577f83248ff9c4ae2363aaeb9714e07f30d4501e5a3b6b1
SSDEEP 49152:019CLUydZJ3XxXgLxXkKLgfF2/Et7zIqFfY4:019eJWNULYsNJm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
nffplp.com
Port
587
Username
[email protected]
Password
$Nke%8XIIDtm
Email to
[email protected]

Targets

- Target
  eca76bae7cf6ffdfef6269b5eae8bca702663e3c2b7f7aca6b9d4d194276acca.exe
- Size 1.8MB
- SHA256 eca76bae7cf6ffdfef6269b5eae8bca702663e3c2b7f7aca6b9d4d194276acca
- MD5 cf4379cf7675fc254a58b06862e47850
- SHA1 c08cc4c7c7677b5747e6754de482d3c0869d9d9a
- SHA512 ea615f2a34a7e517f8f22ea74660262cc6b3d430088abb053aeb201cd95c9be6d912fd0b2c6f55b3b577f83248ff9c4ae2363aaeb9714e07f30d4501e5a3b6b1
- SSDEEP 49152:019CLUydZJ3XxXgLxXkKLgfF2/Et7zIqFfY4:019eJWNULYsNJm
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops startup file
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Agenttesla family

Suspicious use of NtCreateUserProcessOtherParentProcess

Drops startup file

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2