agenttesla

General

Target

USD67,884.08_Payment_Advise_9083008849.exe
Size

860KB
Sample

201121-lxteb61sgs
MD5

947edeb169369ac67c5448cc2f8104a3
SHA1

5d2181f018ab4b8afd6b193e4651233b44ad7d62
SHA256

3a89a79e825bf330e3ea46f6a5f548529b642dc61219a8deeaec070a0688a08e
SHA512

798b7004b2019ffbff67a1f3636ad7dd3b93ef0a9338960d8a7e69eda79aa7d9e097aa888b68f942e21f0a89e98dca66d679f56d06b9ab7b81c4241b1f5840f8

Score

10^/10

Malware Config

Targets

- Target
  
  USD67,884.08_Payment_Advise_9083008849.exe
- Size
  
  860KB
- MD5
  
  947edeb169369ac67c5448cc2f8104a3
- SHA1
  
  5d2181f018ab4b8afd6b193e4651233b44ad7d62
- SHA256
  
  3a89a79e825bf330e3ea46f6a5f548529b642dc61219a8deeaec070a0688a08e
- SHA512
  
  798b7004b2019ffbff67a1f3636ad7dd3b93ef0a9338960d8a7e69eda79aa7d9e097aa888b68f942e21f0a89e98dca66d679f56d06b9ab7b81c4241b1f5840f8
Score

10^/10

agenttesla modiloader keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- AgentTesla Payload
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Targets

ModiLoader, DBatLoader

AgentTesla Payload

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2