agenttesla | ab409eb4fbf6ed4db06f0e3b89d0001869ec46daa85b85b1237f72e6cfaadb6c | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
DHL_FORM-986753029PDF.exe
Size 778KB
Sample200706-mgw4nl22x2
SHA256 ab409eb4fbf6ed4db06f0e3b89d0001869ec46daa85b85b1237f72e6cfaadb6c
MD5 3d73e72f80d7846d02d3a81355cc6230
SHA1 b495bc49fe4b16d78cbe95b87a8ee07cd7e25a07
SHA512 fbfdd7b4b24341cd83fef8beb2edab0cbbed4dc0ac5ef20c62a3eba4d28afe607e3893d686a7cf0bac29a1baddd8cf6dc65b2db9684c163726d820de8de021af
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.yandex.com
Port
587
Username
[email protected]
Password
farmer22

Targets

- Target
  DHL_FORM-986753029PDF.exe
- Size 778KB
- SHA256 ab409eb4fbf6ed4db06f0e3b89d0001869ec46daa85b85b1237f72e6cfaadb6c
- MD5 3d73e72f80d7846d02d3a81355cc6230
- SHA1 b495bc49fe4b16d78cbe95b87a8ee07cd7e25a07
- SHA512 fbfdd7b4b24341cd83fef8beb2edab0cbbed4dc0ac5ef20c62a3eba4d28afe607e3893d686a7cf0bac29a1baddd8cf6dc65b2db9684c163726d820de8de021af
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslakeyloggerspywarestealertrojan