agenttesla | a563a898ce1c8dcac374ef8a468e39a185ca3b010f1a41b60731a7beac23f846 | Triage™

Login
Reports

Overview

overview

Static

static

POLwtksTxCFgqh7.exe

windows7_x64

POLwtksTxCFgqh7.exe

windows10_x64

Sharing

Copy URL Twitter E-mail

General

Target
POLwtksTxCFgqh7.exe
Size 469KB
Sample201109-8fln58fq8j
SHA256 a563a898ce1c8dcac374ef8a468e39a185ca3b010f1a41b60731a7beac23f846
MD5 5d272c686eeb536b59cc1e899e47c07b
SHA1 a40f0308d6566b917ac5a612d6f9eca57f63eca6
SHA512 d25dd0d00316b7dc68caf58b1eae4478edea1d1ff6b65cc797b6b11029a0e8f3d72b770fcf43d8f717631832d20b76069924c361c7fc13c25f2329920f705ad3
MD5 SHA1 SHA512

Score

10^/10

agenttesla evasion keylogger spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

POLwtksTxCFgqh7.exe

Resource

win7v20201028

windows7_x64

0 signatures

0 seconds

agenttesla evasion keylogger spyware stealer trojan

Behavioral task

behavioral2

Sample

POLwtksTxCFgqh7.exe

Resource

win10v20201028

windows10_x64

0 signatures

0 seconds

agenttesla evasion keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.islandkingpools.com
Port
587
Username
[email protected]
Password
Accounts$678

Extracted

Credentials

Protocol
smtp
Host
mail.islandkingpools.com
Port
587
Username
[email protected]
Password
Accounts$678

Targets

- Target
  POLwtksTxCFgqh7.exe
- Size 469KB
- SHA256 a563a898ce1c8dcac374ef8a468e39a185ca3b010f1a41b60731a7beac23f846
- MD5 5d272c686eeb536b59cc1e899e47c07b
- SHA1 a40f0308d6566b917ac5a612d6f9eca57f63eca6
- SHA512 d25dd0d00316b7dc68caf58b1eae4478edea1d1ff6b65cc797b6b11029a0e8f3d72b770fcf43d8f717631832d20b76069924c361c7fc13c25f2329920f705ad3
- MD5 SHA1 SHA512
Score

10^/10

agenttesla evasion keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- AgentTesla Payload
- Drops file in Drivers directory
- Windows security modification
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslaevasionkeyloggerspywarestealertrojan

behavioral2

agentteslaevasionkeyloggerspywarestealertrojan

© 2018-2026

Terms | Privacy