agenttesla | 4d3921886e9f29681da48f378e792b39d307a1c3e39730993e60375b1007d87e | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
PI 2020721233.exe
Size 1.0MB
Sample200715-j2794qs68s
SHA256 4d3921886e9f29681da48f378e792b39d307a1c3e39730993e60375b1007d87e
MD5 6dd53f259450823e6b2831a7bf79189b
SHA1 3a1e709ac316535dc1cb65cd85925d8c22be6970
SHA512 eb8402d01cad05e06114e33b34d86c3a86c42d197b120ccdf370ff04cf046ab34c76d0fdc72a43f0e25e459218c36312973555d6a29f0e4c18ac835822b4865c
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
zstcznz.org
Port
587
Username
[email protected]
Password
makonyo@2017

Targets

- Target
  PI 2020721233.exe
- Size 1.0MB
- SHA256 4d3921886e9f29681da48f378e792b39d307a1c3e39730993e60375b1007d87e
- MD5 6dd53f259450823e6b2831a7bf79189b
- SHA1 3a1e709ac316535dc1cb65cd85925d8c22be6970
- SHA512 eb8402d01cad05e06114e33b34d86c3a86c42d197b120ccdf370ff04cf046ab34c76d0fdc72a43f0e25e459218c36312973555d6a29f0e4c18ac835822b4865c
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslakeyloggerspywarestealertrojan