agenttesla | 0d736040f6fcab61ef390639d0f9deb1270c8b3492dd7abd9cdc8ec43a100364

General

Target
Copia de transferencia de pago.exe
Size 462KB
Sample260828-thfltazwgv
SHA256 0d736040f6fcab61ef390639d0f9deb1270c8b3492dd7abd9cdc8ec43a100364
MD5 bcc045419794480cd9afb160123ce04d
SHA1 963196a591d532d5d162550e4a363d0dd4783882
SHA512 f2e5d57d27aef98b39d93fb29eb5ebccf2411c2618ac8241859fd1b3c1a6a597995662f504bdaedcb09fe88bf4770ba148a37e907c0755580bd23a1c3fce3014
SSDEEP 6144:kqAEMWEhW4s4I8if5Xh/slOvJXMbJZSfG9BPTmrrUurtrTjjTGpzHXEOYV0cVffN:pEQpvXcO6/SfG+rvrtr3OZHSiT+F
TLSH
T105A47BA457FC4B25E6FF1B3D9831544847BAFF4BE839EB6D4A10A8E91D237416810B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.brightlearning.com.my
Port
21
Username
[email protected]
Password
MQ*H0OeM0ASl

Targets

- Target
  Copia de transferencia de pago.exe
- Size 462KB
- SHA256 0d736040f6fcab61ef390639d0f9deb1270c8b3492dd7abd9cdc8ec43a100364
- MD5 bcc045419794480cd9afb160123ce04d
- SHA1 963196a591d532d5d162550e4a363d0dd4783882
- SHA512 f2e5d57d27aef98b39d93fb29eb5ebccf2411c2618ac8241859fd1b3c1a6a597995662f504bdaedcb09fe88bf4770ba148a37e907c0755580bd23a1c3fce3014
- SSDEEP 6144:kqAEMWEhW4s4I8if5Xh/slOvJXMbJZSfG9BPTmrrUurtrTjjTGpzHXEOYV0cVffN:pEQpvXcO6/SfG+rvrtr3OZHSiT+F
- TLSH
  T105A47BA457FC4B25E6FF1B3D9831544847BAFF4BE839EB6D4A10A8E91D237416810B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery agenttesla keylogger spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: AgentTesla

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2