agenttesla | 3587f9301992c8441bfc49ae3aab399efb1fd8e5291e47be77327a5d13776e90

General

Target
e3070290906a9eda5855e73545e4a349e3db06a6be3479e46ec19b26dd073c33 (1).zip
Size 964KB
Sample260707-a1demaew4t
SHA256 3587f9301992c8441bfc49ae3aab399efb1fd8e5291e47be77327a5d13776e90
MD5 3db9c1044f0fe9c3880bd4157b94427e
SHA1 9d39c3b6040799d13a842bd79041189f7292826e
SHA512 3e9a4613476270e660fa57113c23e3a7bafbe1202129813600437fc5df3574d7029761b62fc21e732a3b0c89dd362b34964ddcae5152c8c4288e5f043771b0e0
SSDEEP 24576:5ZnjZ9dndK/OlzxrsQ5Wfi2gDX+grbqHA+jPl0kXx00Zg/yECdbr+EOP:5ZjZHndlze3/grbqHA+jPlmIEyjAE4
TLSH
T1E72533771EFE52C2609D49E5C528F9867F12D384065B132C2BDE3AC6DF9162F38488E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.freshnest2u.com
Port
21
Username
[email protected]
Password
2XbKWdXGZxUrsYff

Targets

- Target
  e3070290906a9eda5855e73545e4a349e3db06a6be3479e46ec19b26dd073c33.exe
- Size 1.1MB
- SHA256 e3070290906a9eda5855e73545e4a349e3db06a6be3479e46ec19b26dd073c33
- MD5 e97a23b000d8b8955f1fdbf1d7576675
- SHA1 7c9000955642ce7a1f2aa06bc053ad4aa9a8e461
- SHA512 78e54ca1ba3b1e17b454ba6f8866525a9b18115f20be8576005a41b36438a5947128f36248a5a2a5cedc5fa19e146c107b83cc1ad85d3849f6f1bfac45a48c45
- SSDEEP 24576:PAfvV0LAfT29SgkZFtcopU74g4aT2sJN6Nsslyv:PAfN0LAr29bklcoDXTsJNwsB
- TLSH
  T1F93501446B5CDE02C1AA177464B4E2380B786E5AF910E3171FD4BDEB7DBBB128C1528B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery agenttesla keylogger spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- SmartAssembly .NET packer
  Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: AgentTesla

Accesses Microsoft Outlook profiles

SmartAssembly .NET packer

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2