agenttesla | f43019ee4884c1c23ff804808fdb30691b151eb4a7ae6521d6757fde03a32833

General

Target
Lista de productos.exe
Size 718KB
Sample260901-2nbttasyft
SHA256 f43019ee4884c1c23ff804808fdb30691b151eb4a7ae6521d6757fde03a32833
MD5 148e99089ecbe9cffadddd4f8f0114b2
SHA1 70cacfdb8e224c1f19eb529de04ca2ef4c0aa24e
SHA512 cb592e6ce7cca5c023062ec4c42a4ff883b966ebe3f86f69b7623f81022448bff854470087b8dfeb457abca72ac7c65a165050e70afa350cac0e313bd8315ba1
SSDEEP 6144:yxR3GVtv6Ktq1ilHK3rsjv5+MZm4zWXDB2/8k2FU9fX+XgkKqOWQkXBx6/mKPrUT:cRheROAb3Em5ll/UTG5ygAoG
TLSH
T1FFF47D6536608664CBB94B3A59638104673C5086ABFFC7023AF71DBCACC3BD649493B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.brightlearning.com.my
Port
21
Username
[email protected]
Password
MQ*H0OeM0ASl

Targets

- Target
  Lista de productos.exe
- Size 718KB
- SHA256 f43019ee4884c1c23ff804808fdb30691b151eb4a7ae6521d6757fde03a32833
- MD5 148e99089ecbe9cffadddd4f8f0114b2
- SHA1 70cacfdb8e224c1f19eb529de04ca2ef4c0aa24e
- SHA512 cb592e6ce7cca5c023062ec4c42a4ff883b966ebe3f86f69b7623f81022448bff854470087b8dfeb457abca72ac7c65a165050e70afa350cac0e313bd8315ba1
- SSDEEP 6144:yxR3GVtv6Ktq1ilHK3rsjv5+MZm4zWXDB2/8k2FU9fX+XgkKqOWQkXBx6/mKPrUT:cRheROAb3Em5ll/UTG5ygAoG
- TLSH
  T1FFF47D6536608664CBB94B3A59638104673C5086ABFFC7023AF71DBCACC3BD649493B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery agenttesla keylogger spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: AgentTesla

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2