agenttesla | b3db12ee110a51adbbbe9901d5c5ad135aae575a37a8f2a5632b88eedacede6a | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
yuio.exe
Size 1.2MB
Sample201013-e4pshxxzq2
SHA256 b3db12ee110a51adbbbe9901d5c5ad135aae575a37a8f2a5632b88eedacede6a
MD5 5f60085af8bbbee03adca9f4d76fd6da
SHA1 3fee68f36e0a596b96e56269c0833b853e9d404e
SHA512 ee0a95a28814b85123218d5ad086bbf1ee9fa70fd93b990d57710e5e85620b599796ca627003039761543b5e2f7887dcb9141ab2cba0eedc9490566d480a65c3
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.ersanet.com.tr
Port
587
Username
[email protected]
Password
ersan16

Targets

- Target
  yuio.exe
- Size 1.2MB
- SHA256 b3db12ee110a51adbbbe9901d5c5ad135aae575a37a8f2a5632b88eedacede6a
- MD5 5f60085af8bbbee03adca9f4d76fd6da
- SHA1 3fee68f36e0a596b96e56269c0833b853e9d404e
- SHA512 ee0a95a28814b85123218d5ad086bbf1ee9fa70fd93b990d57710e5e85620b599796ca627003039761543b5e2f7887dcb9141ab2cba0eedc9490566d480a65c3
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Drops startup file
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2