agenttesla

General

Target
z41factura-9876.exe
Size 567KB
Sample251204-rbae4sft4f
SHA256 db2271f6304ac6140d219a6a092c757e07dbe0fc342d62b9ba83dc7e0f005cda
MD5 3a4b22482d0b721bc575dec6ac990e02
SHA1 8d7384ce0a006f95010c9a2a067a2fd28b5d796d
SHA512 89bf2652870bb1ad9bdf8d90cb1509e3e23d36fe32b138da538902031c4d7a5b4c5cf2f6411b562e5b383f4e3462692f549ca58479ca8d2467a7f48f806b0438
SSDEEP 12288:Iz7hU5I5yuNHIgzSFKxWltRohBfSTso93Ue/IF/rWmUKY:If+iN57Gtene3LEWmUKY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.ionos.es
Port
587
Username
[email protected]
Password
Playa.2022Sol
Email to
[email protected]

Targets

- Target
  z41factura-9876.exe
- Size 567KB
- SHA256 db2271f6304ac6140d219a6a092c757e07dbe0fc342d62b9ba83dc7e0f005cda
- MD5 3a4b22482d0b721bc575dec6ac990e02
- SHA1 8d7384ce0a006f95010c9a2a067a2fd28b5d796d
- SHA512 89bf2652870bb1ad9bdf8d90cb1509e3e23d36fe32b138da538902031c4d7a5b4c5cf2f6411b562e5b383f4e3462692f549ca58479ca8d2467a7f48f806b0438
- SSDEEP 12288:Iz7hU5I5yuNHIgzSFKxWltRohBfSTso93Ue/IF/rWmUKY:If+iN57Gtene3LEWmUKY
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery agenttesla keylogger spyware stealer trojan upx
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Drops startup file
- Executes dropped EXE
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Agenttesla family

Drops startup file

Executes dropped EXE

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2