agenttesla | e149a102d8d46f836240231143538c91f2d4bf6f4dc37fbd3cc20d0813ddcdb8 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
02_extracted.exe
Size 1.4MB
Sample200624-dy1hak6vse
SHA256 e149a102d8d46f836240231143538c91f2d4bf6f4dc37fbd3cc20d0813ddcdb8
MD5 aa6b21d6aba228278fbd1241622fcf58
SHA1 989ebf5b8719cfc24f01168f21f4d1183bc476ad
SHA512 ccc4f4a07f4913d3a87822622e94b00510a481487b72a1621c0e587c9b31d56f2819f545d2a63456e79424ac2ec72bcd0ace8d6e63d1670bb508060c796b3426
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
flexo.verat.net
Port
587
Username
[email protected]
Password
lekan@123

Targets

- Target
  02_extracted.exe
- Size 1.4MB
- SHA256 e149a102d8d46f836240231143538c91f2d4bf6f4dc37fbd3cc20d0813ddcdb8
- MD5 aa6b21d6aba228278fbd1241622fcf58
- SHA1 989ebf5b8719cfc24f01168f21f4d1183bc476ad
- SHA512 ccc4f4a07f4913d3a87822622e94b00510a481487b72a1621c0e587c9b31d56f2819f545d2a63456e79424ac2ec72bcd0ace8d6e63d1670bb508060c796b3426
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Drops startup file
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslakeyloggerspywarestealertrojan