agenttesla | d49e7583369c71089fd6fafd4eb63e4b0e3af1f34ea08236ed425d4a09f0450d

General

Target
d49e7583369c71089fd6fafd4eb63e4b0e3af1f34ea08236ed425d4a09f0450d.bin
Size 286KB
Sample260702-s7pqcaes2n
SHA256 d49e7583369c71089fd6fafd4eb63e4b0e3af1f34ea08236ed425d4a09f0450d
MD5 9d6252413b138517c2ce406d99d53c64
SHA1 0b747a13c087cee84b819177aac5c8fe0c9322e2
SHA512 b3812e514b9225f6c8119c56963efb17a9ffe9d46c92730b96977fba569dbb96e4aa296dc79d1d36034ba902f274edc6afb2515f6aaf413f3b3754d0163821be
SSDEEP 6144:EVRlr/JbEqFeSv7fATHeboq5L3e+PinJdYu:ERDTv7iHetLOdD/
TLSH
T1745402552B4979C7FE71DA31CE37D2F2281161459B2129E63F987A0F09FE0C2DB17258
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.duct-master.com
Port
21
Username
[email protected]
Password
t{q~zwL^r7HdcUh1

Targets

- Target
  Nomina_01_07_2026.exe
- Size 129.0MB
- SHA256 70644ae3dd0161c3f30b14fcd0d34583be4065fe737a437b52bf629cfa8a0f25
- MD5 cdccf6f8f4f19ca8766c33e15531154c
- SHA1 7b55240d4627e8c366d10bad20074257af680f7f
- SHA512 eceb0e8dd937ef5ad95fbc3bc2715730458e6a1fc2b0aa70c6817ca78b020f0f6cd64c814e9e28648491899d57963e28d663d526725e8d8cface4cbbd3d893b4
- SSDEEP 6144:M0Mm4CCx78Zmfz2vymL4DuAKo60NmSBZWy5/Nn/E/+TMjiBA:7MwI74gSymLMupo6Ems/F/XMji
- TLSH
  T1505812023754D477E7B34A302C3281A55EF6ABEA2547939F675096DA2C31B429F0F33A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery agenttesla keylogger spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: AgentTesla

Loads dropped DLL

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2