agenttesla | 733258140e397a26743a3a559b6961324ef07b03291d07699b2b4f4ecc5c8a0b | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
HONEYWELL RFQ.exe
Size 1.4MB
Sample201109-e4848kgdde
SHA256 733258140e397a26743a3a559b6961324ef07b03291d07699b2b4f4ecc5c8a0b
MD5 6389ad387f9c82d8ca43e1040cb65341
SHA1 bd0829eab65a3350c0bd373589d2317e5ea12239
SHA512 c04c09c58eca80355f3f4a84216e744ec36ce2d59a065c17beebcfcb8dee82baf8a516812c987e55592b2c25b68f4c9f3570120021a25af6759aeafb48f4c82d
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.radianthospitals.org
Port
587
Username
[email protected]
Password
ifeanyi12345678

Targets

- Target
  HONEYWELL RFQ.exe
- Size 1.4MB
- SHA256 733258140e397a26743a3a559b6961324ef07b03291d07699b2b4f4ecc5c8a0b
- MD5 6389ad387f9c82d8ca43e1040cb65341
- SHA1 bd0829eab65a3350c0bd373589d2317e5ea12239
- SHA512 c04c09c58eca80355f3f4a84216e744ec36ce2d59a065c17beebcfcb8dee82baf8a516812c987e55592b2c25b68f4c9f3570120021a25af6759aeafb48f4c82d
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslakeyloggerspywarestealertrojan