agenttesla | bc82c7456057b8785d9781eca9a34d809432857cc58dd80e7f54cf079ffac60f

General

Target
bc82c7456057b8785d9781eca9a34d809432857cc58dd80e7f54cf079ffac60f.exe
Size 1.0MB
Sample260608-klpt8aax7l
SHA256 bc82c7456057b8785d9781eca9a34d809432857cc58dd80e7f54cf079ffac60f
MD5 614ea2278c5b8df8efa0a3d3a6044ecb
SHA1 1a0e3fe084c673ad1544c0de82bbc1a58025be97
SHA512 cab9995db85ec58b5a545588d2ee69ba2a50be50e62857219d2df33c6c3780eb4992c166fcb76915c501c6a76cf58dedb8fecb261c5cec32afb5ebcc8c15f191
SSDEEP 24576:VnbgoHa7ewG3O1MOj6NUB+hKvquTwMsquomJhiR:Vge3+N6Q+hKyqwMVubTi
TLSH
T1FC250114321EDD06D4B79BB948B0E7B407B46E44B931D2039EE9BEEB783A7915C183D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.abdulsalam.com.my
Port
21
Username
[email protected]
Password
UsF=[0cR)vI1q7LZ

Targets

- Target
  bc82c7456057b8785d9781eca9a34d809432857cc58dd80e7f54cf079ffac60f.exe
- Size 1.0MB
- SHA256 bc82c7456057b8785d9781eca9a34d809432857cc58dd80e7f54cf079ffac60f
- MD5 614ea2278c5b8df8efa0a3d3a6044ecb
- SHA1 1a0e3fe084c673ad1544c0de82bbc1a58025be97
- SHA512 cab9995db85ec58b5a545588d2ee69ba2a50be50e62857219d2df33c6c3780eb4992c166fcb76915c501c6a76cf58dedb8fecb261c5cec32afb5ebcc8c15f191
- SSDEEP 24576:VnbgoHa7ewG3O1MOj6NUB+hKvquTwMsquomJhiR:Vge3+N6Q+hKyqwMVubTi
- TLSH
  T1FC250114321EDD06D4B79BB948B0E7B407B46E44B931D2039EE9BEEB783A7915C183D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery agenttesla keylogger spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: AgentTesla

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2