agenttesla | 407cbbb0272e99c1b653632030a39f05ca1d4e32c3e9de10d2e44c95ad7575ef

General

Target
Purchase_Order_P.O_2025052.exe
Size 1.0MB
Sample260520-v6kfcaez4l
SHA256 407cbbb0272e99c1b653632030a39f05ca1d4e32c3e9de10d2e44c95ad7575ef
MD5 04a8f2ba2cce59f871643b84be5f1358
SHA1 161cdb67f91f2887eefc6e8b6d7c18b6c31b394a
SHA512 348ffaae559b2b0567b18fc9c2755edcf4f9e07671ab697fdddbc64b4d1a737cab260443012de4fc4dfaefe9794c2a4335c7bda13e16421048366881b2594265
SSDEEP 24576:utb20pkaCqT5TBWgNQ7aHrdnU7cwPsK6A:bVg5tQ7aHriAwL5
TLSH
T1FD35BE1273DEC3A4C77251737A6677026FBB782A06A5F85B2FD8093CB920121525FA73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.yandex.com
Port
587
Username
[email protected]
Password
marcellinus360
Email to
[email protected]

Targets

- Target
  Purchase_Order_P.O_2025052.exe
- Size 1.0MB
- SHA256 407cbbb0272e99c1b653632030a39f05ca1d4e32c3e9de10d2e44c95ad7575ef
- MD5 04a8f2ba2cce59f871643b84be5f1358
- SHA1 161cdb67f91f2887eefc6e8b6d7c18b6c31b394a
- SHA512 348ffaae559b2b0567b18fc9c2755edcf4f9e07671ab697fdddbc64b4d1a737cab260443012de4fc4dfaefe9794c2a4335c7bda13e16421048366881b2594265
- SSDEEP 24576:utb20pkaCqT5TBWgNQ7aHrdnU7cwPsK6A:bVg5tQ7aHriAwL5
- TLSH
  T1FD35BE1273DEC3A4C77251737A6677026FBB782A06A5F85B2FD8093CB920121525FA73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery agenttesla keylogger spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Drops startup file
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: AgentTesla

Drops startup file

Executes dropped EXE

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

AutoIT Executable

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2