agenttesla

General

Target
documentos_datos bancarios.PDF.exe
Size 45KB
Sample220304-g67c8afdan
SHA256 ea930b3655ed7afd7121e9ed20477a2b1849a7bb2a3f51d5b67697dc1614202c
MD5 a25bb18dc3131e6e267f39755aee468b
SHA1 8d7e8ffdcfac76593a05196d0cad0b0245197890
SHA512 3f1e062dd11b308bb855f606e65bf2be9d749a123d0e2b022f09ffee23f11caff047917e33f62f43a8f111962393831532a53b5d82bd59e53ee5c868c397d8d7
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.centraldefiltros.cl
Port
587
Username
[email protected]
Password
icui4cu2@@
Email to
[email protected]

Targets

- Target
  documentos_datos bancarios.PDF.exe
- Size 45KB
- SHA256 ea930b3655ed7afd7121e9ed20477a2b1849a7bb2a3f51d5b67697dc1614202c
- MD5 a25bb18dc3131e6e267f39755aee468b
- SHA1 8d7e8ffdcfac76593a05196d0cad0b0245197890
- SHA512 3f1e062dd11b308bb855f606e65bf2be9d749a123d0e2b022f09ffee23f11caff047917e33f62f43a8f111962393831532a53b5d82bd59e53ee5c868c397d8d7
- MD5 SHA1 SHA512
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla Payload

Checks computer location settings

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2