agenttesla | cff6792a6cccf7d929b62d65c62bbd99dfcb07698304804bdbddd86d4b39e3ae | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Inv00911.exe
Size 1.5MB
Sample201109-b49xp4ahfj
SHA256 cff6792a6cccf7d929b62d65c62bbd99dfcb07698304804bdbddd86d4b39e3ae
MD5 8e7cc0ebb8b7ec69caa3181df4fe0a52
SHA1 41c726de4133b5382caa86767f049a60485c20d7
SHA512 c53d06847732b36bb2dd0752f3c57456db79049c50bbd288b5e315247d506e0cab13fe6bfe4d461f8c15f122a5b8b04234f67c3e08455f67b64d1f8994168c64
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.chinagrill.co
Port
587
Username
[email protected]
Password
SnIVrXH!]f1q

Targets

- Target
  Inv00911.exe
- Size 1.5MB
- SHA256 cff6792a6cccf7d929b62d65c62bbd99dfcb07698304804bdbddd86d4b39e3ae
- MD5 8e7cc0ebb8b7ec69caa3181df4fe0a52
- SHA1 41c726de4133b5382caa86767f049a60485c20d7
- SHA512 c53d06847732b36bb2dd0752f3c57456db79049c50bbd288b5e315247d506e0cab13fe6bfe4d461f8c15f122a5b8b04234f67c3e08455f67b64d1f8994168c64
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Drops startup file
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslakeyloggerspywarestealertrojan