agenttesla

General

Target
DHL consignment number_600595460.exe
Size 123KB
Sample211014-l991qsgger
SHA256 07e998bad81bb4b3bfccffc32a3e9aaac2635e98d1454e98eafb3cdb027e93e9
MD5 b8919ac567300aab07193b9df3af2ae5
SHA1 bb1781fcf1c02abacb677cee6155f2186b88715c
SHA512 d75ab5f2582a4ad1d7d59ff654c3655e4798edf7e2edb1f69c70623227de3ddacd7638b0c2a351e3d14520749f8aba89cb54a7a68c3e10569916edd1b256556e
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.vimc-shlpping.com
Port
587
Username
[email protected]
Password
dfBQe!^5

Targets

- Target
  DHL consignment number_600595460.exe
- Size 123KB
- SHA256 07e998bad81bb4b3bfccffc32a3e9aaac2635e98d1454e98eafb3cdb027e93e9
- MD5 b8919ac567300aab07193b9df3af2ae5
- SHA1 bb1781fcf1c02abacb677cee6155f2186b88715c
- SHA512 d75ab5f2582a4ad1d7d59ff654c3655e4798edf7e2edb1f69c70623227de3ddacd7638b0c2a351e3d14520749f8aba89cb54a7a68c3e10569916edd1b256556e
- MD5 SHA1 SHA512
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Downloads MZ/PE file
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla Payload

Downloads MZ/PE file

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2