agenttesla

General

Target
Aviso de pago.pdf____________________________.exe
Size 54KB
Sample220513-skk4msgge8
SHA256 6797c9eb17e1ad3b41121bc80db0a97ae642bfca0874c8b7bd391507d2ca5540
MD5 05b6b97166b339557424ca035418a640
SHA1 e1699c9c10d6807650fcc35fc76c7744deeb16be
SHA512 0e2c6febd221d1c2e8a465dca46037ab6f826d5780c0ccb7bface146a15d1031124ddd5097b77f275a0714751559a77b8ea4cc4959c37d7ff336c6a3690ee7c8
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.permagraf.com.mx
Port
587
Username
[email protected]
Password
icui4cu2@@
Email to
[email protected]

Targets

- Target
  Aviso de pago.pdf____________________________.exe
- Size 54KB
- SHA256 6797c9eb17e1ad3b41121bc80db0a97ae642bfca0874c8b7bd391507d2ca5540
- MD5 05b6b97166b339557424ca035418a640
- SHA1 e1699c9c10d6807650fcc35fc76c7744deeb16be
- SHA512 0e2c6febd221d1c2e8a465dca46037ab6f826d5780c0ccb7bface146a15d1031124ddd5097b77f275a0714751559a77b8ea4cc4959c37d7ff336c6a3690ee7c8
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan collection
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla Payload

Checks computer location settings

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2