agenttesla | 42f7c2e83a58bc634ca3953f74a959e42d5124e2e09bf4c8e76ae285c61f784d | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
RFQ-BE2100.exe
Size 1.5MB
Sample201109-2bcs7wehwe
SHA256 42f7c2e83a58bc634ca3953f74a959e42d5124e2e09bf4c8e76ae285c61f784d
MD5 5d5cbf47ab3f53d8cfaaea4824ecfa95
SHA1 176e5f18435b5aa25c5a355b43eb82897e82b367
SHA512 2ddcdda605e55d3fe1d6b050ab4012bffc0a1ed90bedfd1df666f649e9886717cdb38ea99efba20e3b71f09d9e120ae5dea8416116393112fc2424f607e3c790
MD5 SHA1 SHA512

Score

10^/10

agenttesla nanocore keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.coastalinternational.in
Port
587
Username
[email protected]
Password
r7i7t7h7u

Targets

- Target
  RFQ-BE2100.exe
- Size 1.5MB
- SHA256 42f7c2e83a58bc634ca3953f74a959e42d5124e2e09bf4c8e76ae285c61f784d
- MD5 5d5cbf47ab3f53d8cfaaea4824ecfa95
- SHA1 176e5f18435b5aa25c5a355b43eb82897e82b367
- SHA512 2ddcdda605e55d3fe1d6b050ab4012bffc0a1ed90bedfd1df666f649e9886717cdb38ea99efba20e3b71f09d9e120ae5dea8416116393112fc2424f607e3c790
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan nanocore
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- AgentTesla Payload
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslananocorekeyloggerspywarestealertrojan