agenttesla | 1eb80076d32a7919086f64f0fd8bbb87f2116992719c9d67e679f3c76a2e9392 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
DHL 08102020 0013456 09876.exe
Size 770KB
Sample200810-dzflt5kkzn
SHA256 1eb80076d32a7919086f64f0fd8bbb87f2116992719c9d67e679f3c76a2e9392
MD5 7ba4cbfd2c65ee56f79122c087a5cb3d
SHA1 b0952fe773b43850742bf8ca0e7e69b87e4042de
SHA512 d6695512546c6e77d40e4a25b76dd79f50323ee5dc3cda24f149b74d07ca2fd1f4dc1795e738d6b137ae311104a6fbb79811676db13d7f902b6a7c9de680067d
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.wtgriderline.com
Port
587
Username
[email protected]
Password
wyiKluF9

Targets

- Target
  DHL 08102020 0013456 09876.exe
- Size 770KB
- SHA256 1eb80076d32a7919086f64f0fd8bbb87f2116992719c9d67e679f3c76a2e9392
- MD5 7ba4cbfd2c65ee56f79122c087a5cb3d
- SHA1 b0952fe773b43850742bf8ca0e7e69b87e4042de
- SHA512 d6695512546c6e77d40e4a25b76dd79f50323ee5dc3cda24f149b74d07ca2fd1f4dc1795e738d6b137ae311104a6fbb79811676db13d7f902b6a7c9de680067d
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslakeyloggerspywarestealertrojan