agenttesla

General

Target
6a58063fd4bfe4c9fd2bb7b17216fe3353a358a404d8b162d8b6f2a9bfc7b625.exe
Size 1.0MB
Sample250905-rlcm8a1vcw
SHA256 6a58063fd4bfe4c9fd2bb7b17216fe3353a358a404d8b162d8b6f2a9bfc7b625
MD5 10fad73bcab03506e26422b9f2069eef
SHA1 17150765f31100cf660d14cc8376f854d1fee379
SHA512 1e56e9bbc0356ea97c75f8650fa1795c6aca7d8d726c41c840f68c8f8bda30c8db9f8eaca5846a108e579f80976b62742992d92a1b283e7e193d8cdba7d2ae3a
SSDEEP 24576:Bnzx2PCC7MIrKTTIOJofW3cLdD9ovATQGj52xS6f4qKkev3:BE6ro0Ofsc+IEGj52xFfMk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.iaa-airferight.com
Port
587
Username
[email protected]
Password
webmaster
Email to
[email protected]

Targets

- Target
  6a58063fd4bfe4c9fd2bb7b17216fe3353a358a404d8b162d8b6f2a9bfc7b625.exe
- Size 1.0MB
- SHA256 6a58063fd4bfe4c9fd2bb7b17216fe3353a358a404d8b162d8b6f2a9bfc7b625
- MD5 10fad73bcab03506e26422b9f2069eef
- SHA1 17150765f31100cf660d14cc8376f854d1fee379
- SHA512 1e56e9bbc0356ea97c75f8650fa1795c6aca7d8d726c41c840f68c8f8bda30c8db9f8eaca5846a108e579f80976b62742992d92a1b283e7e193d8cdba7d2ae3a
- SSDEEP 24576:Bnzx2PCC7MIrKTTIOJofW3cLdD9ovATQGj52xS6f4qKkev3:BE6ro0Ofsc+IEGj52xFfMk
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Drops startup file
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Agenttesla family

Drops startup file

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2