agenttesla

General

Target
SecuriteInfo.com.TrojanDownloader.MSIL.Wagex.0948aed6.9404.22452
Size 31KB
Sample220824-e64wzshdd3
SHA256 7fe2f4dfcaa95ada58ceedbd567c738dbe04a4919880b5ad3d9751d76b2f9919
MD5 8b76dc3d3bf87db071087097c37c0cee
SHA1 75e8b0e034abe1e47b9b76b3b92769750304d2bc
SHA512 37fb4238043ee50ece8812c55ef6a82e6982898470ae98d8a2fde43c8ce171d4b9ae7f378d2775e21063c4396665a5cc0552245f505ad2b4e294ac76f44f840d
SSDEEP 384:uPvm0ahdzwtgulqPLDmicDFwQzYGqVgW+vNest:uHNaLUYDSXwQzYPVAt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.barqaab.com
Port
587
Username
[email protected]
Password
Great@999@

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.barqaab.com
Port
587
Username
[email protected]
Password
Great@999@
Email to
[email protected]

Targets

- Target
  SecuriteInfo.com.TrojanDownloader.MSIL.Wagex.0948aed6.9404.22452
- Size 31KB
- SHA256 7fe2f4dfcaa95ada58ceedbd567c738dbe04a4919880b5ad3d9751d76b2f9919
- MD5 8b76dc3d3bf87db071087097c37c0cee
- SHA1 75e8b0e034abe1e47b9b76b3b92769750304d2bc
- SHA512 37fb4238043ee50ece8812c55ef6a82e6982898470ae98d8a2fde43c8ce171d4b9ae7f378d2775e21063c4396665a5cc0552245f505ad2b4e294ac76f44f840d
- SSDEEP 384:uPvm0ahdzwtgulqPLDmicDFwQzYGqVgW+vNest:uHNaLUYDSXwQzYPVAt
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Checks computer location settings

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2