agenttesla | 31857ab31779658b85e71641c6989c81b8fc65426ba18f527c4078de6e863d0b

General

Target
O.C.4530138144453013816245301381714530138176.exe
Size 1.0MB
Sample260701-2rxkpafw3j
SHA256 31857ab31779658b85e71641c6989c81b8fc65426ba18f527c4078de6e863d0b
MD5 432ea3f66f1383932f5d045b83c86fb0
SHA1 2fcec803e8a59b7843b3b8a9b886fb47865df4d1
SHA512 93b13e6bf7c03881b0f00c2dff0faf330f9145f0450600d7b4f5e1ea3662aad12011ad90f9a2015ab05e40ebb0fa0d22cde31e0688da79250c4055daa1182792
SSDEEP 24576:1qGdMdXf3ftQv+GzXpOvNSE1awH/QdXBFNnn26Xbj8e:1hdcHADXsNSiHSvNnVL
TLSH
T1BA25F1C03B29B709DC686B348535ED7553A92D68B020F9E26EDE3B9778AD3015E0CF52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.twostudioft2812.com
Port
21
Username
[email protected]
Password
li,adNFRpfCo@pGr

Targets

- Target
  O.C.4530138144453013816245301381714530138176.exe
- Size 1.0MB
- SHA256 31857ab31779658b85e71641c6989c81b8fc65426ba18f527c4078de6e863d0b
- MD5 432ea3f66f1383932f5d045b83c86fb0
- SHA1 2fcec803e8a59b7843b3b8a9b886fb47865df4d1
- SHA512 93b13e6bf7c03881b0f00c2dff0faf330f9145f0450600d7b4f5e1ea3662aad12011ad90f9a2015ab05e40ebb0fa0d22cde31e0688da79250c4055daa1182792
- SSDEEP 24576:1qGdMdXf3ftQv+GzXpOvNSE1awH/QdXBFNnn26Xbj8e:1hdcHADXsNSiHSvNnVL
- TLSH
  T1BA25F1C03B29B709DC686B348535ED7553A92D68B020F9E26EDE3B9778AD3015E0CF52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery agenttesla keylogger spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: AgentTesla

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2