agenttesla | b4a49ab94a3bc704c6eb3394df82ebae6e04dd139a765db41db66e65457b0673 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
GEA_5556789
Size 1.4MB
Sample201109-76wrp75dmn
SHA256 b4a49ab94a3bc704c6eb3394df82ebae6e04dd139a765db41db66e65457b0673
MD5 f27fed1c7cb331f04fdcfecedc899c7d
SHA1 abeb646efcb893c29d5e26c01d3cc8b6013b6b22
SHA512 795c78eb55cc65bfeaf880f2b7f34f929e272f434bdbe6760b3521e02eadf638ff6c8b94c5ee64230cc575edbc8d7293078d9e2d16f6f8056614f6adbea92208
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
us2.smtp.mailhostbox.com
Port
587
Username
[email protected]
Password
Wm^kN*!7

Targets

- Target
  GEA_5556789
- Size 1.4MB
- SHA256 b4a49ab94a3bc704c6eb3394df82ebae6e04dd139a765db41db66e65457b0673
- MD5 f27fed1c7cb331f04fdcfecedc899c7d
- SHA1 abeb646efcb893c29d5e26c01d3cc8b6013b6b22
- SHA512 795c78eb55cc65bfeaf880f2b7f34f929e272f434bdbe6760b3521e02eadf638ff6c8b94c5ee64230cc575edbc8d7293078d9e2d16f6f8056614f6adbea92208
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Drops startup file
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslakeyloggerspywarestealertrojan