agenttesla | e8bdbd96cb33b0e92cd7bae8f64e6599627dc3df656fc0a31435cd2bc06bd9a4

General

Target
0d736040f6fcab61ef390639d0f9deb1270c8b3492dd7abd9cdc8ec43a100364.zip
Size 255KB
Sample260830-13kvlade98
SHA256 e8bdbd96cb33b0e92cd7bae8f64e6599627dc3df656fc0a31435cd2bc06bd9a4
MD5 0017fdb8b5d6e5ef908cad3412eef910
SHA1 a2bcb0e1d872dd0f4db64c02133d00f7ae2680ce
SHA512 746507397c93fda19c64d61d74dc336a92498294368132575c0e0a296524c395a801ac9a72f29d65af93c4a56c3b41b290335e3a85766e217d293ae39a8a9519
SSDEEP 6144:GiN6DXyBxVhxC9QuqV42xUlihOm9Qf9o+skjOa:GiN6DCLVhxCeG2xUlicmGf6+H
TLSH
T12244232435D8B730E838995FDF541C3DEF64492B9748FAC7644828BB125B751838B8AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.brightlearning.com.my
Port
21
Username
[email protected]
Password
MQ*H0OeM0ASl

Targets

- Target
  0d736040f6fcab61ef390639d0f9deb1270c8b3492dd7abd9cdc8ec43a100364.exe
- Size 462KB
- SHA256 0d736040f6fcab61ef390639d0f9deb1270c8b3492dd7abd9cdc8ec43a100364
- MD5 bcc045419794480cd9afb160123ce04d
- SHA1 963196a591d532d5d162550e4a363d0dd4783882
- SHA512 f2e5d57d27aef98b39d93fb29eb5ebccf2411c2618ac8241859fd1b3c1a6a597995662f504bdaedcb09fe88bf4770ba148a37e907c0755580bd23a1c3fce3014
- SSDEEP 6144:kqAEMWEhW4s4I8if5Xh/slOvJXMbJZSfG9BPTmrrUurtrTjjTGpzHXEOYV0cVffN:pEQpvXcO6/SfG+rvrtr3OZHSiT+F
- TLSH
  T105A47BA457FC4B25E6FF1B3D9831544847BAFF4BE839EB6D4A10A8E91D237416810B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery agenttesla keylogger spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: AgentTesla

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2