agenttesla | 71d64c0ad1445535eb9d1925632ea8d82c0f18a21bebbb1641df643eb9d26b0d

General

Target
71d64c0ad1445535eb9d1925632ea8d82c0f18a21bebbb1641df643eb9d26b0d.exe
Size 1015KB
Sample260608-klrc2sbs3t
SHA256 71d64c0ad1445535eb9d1925632ea8d82c0f18a21bebbb1641df643eb9d26b0d
MD5 9606d90494e374544c65f7f768b36df9
SHA1 cc45392cda7d554e609fa30907f767d39bd14a27
SHA512 c1e515f856dd0fe6e94c7885ce76e8dc8dc3f63697a2de1510392700dfeedd2ec063d64003a89420637ba956226758bcca309b45b094aadbc1906406f8385c21
SSDEEP 12288:CmNLL9MaurZgQ81wM5WsUiRG7mcrTLysailrSecpEEOio1CygDdgh8zXOS5Nv8Dm:7RSY1fkniHcjyPerS+qpDdHOmMRFaci
TLSH
T162250104231ADD02D4FB8BB94870D7B407B46E59B931E3129EEABDEB78367819C153D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.cyberflor.co
Port
21
Username
[email protected]
Password
C+pG9~zj2odhVHbG

Targets

- Target
  71d64c0ad1445535eb9d1925632ea8d82c0f18a21bebbb1641df643eb9d26b0d.exe
- Size 1015KB
- SHA256 71d64c0ad1445535eb9d1925632ea8d82c0f18a21bebbb1641df643eb9d26b0d
- MD5 9606d90494e374544c65f7f768b36df9
- SHA1 cc45392cda7d554e609fa30907f767d39bd14a27
- SHA512 c1e515f856dd0fe6e94c7885ce76e8dc8dc3f63697a2de1510392700dfeedd2ec063d64003a89420637ba956226758bcca309b45b094aadbc1906406f8385c21
- SSDEEP 12288:CmNLL9MaurZgQ81wM5WsUiRG7mcrTLysailrSecpEEOio1CygDdgh8zXOS5Nv8Dm:7RSY1fkniHcjyPerS+qpDdHOmMRFaci
- TLSH
  T162250104231ADD02D4FB8BB94870D7B407B46E59B931E3129EEABDEB78367819C153D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery agenttesla keylogger spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: AgentTesla

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2