agenttesla | 0b65d9e11e4f234aadd99ac25f0dcd8a57063cc3f8e2e98abb7e1efa1f9ac392 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Commercial Invoice.exe
Size 1.5MB
Sample201109-grvwlf4yp6
SHA256 0b65d9e11e4f234aadd99ac25f0dcd8a57063cc3f8e2e98abb7e1efa1f9ac392
MD5 483c28edb1da9ae6d1698da1ba0052d2
SHA1 9820fe2b1b034a720276988e4f66e349d1f057a7
SHA512 49083f2496b1dc3d9895270beb01f5005ed451a625008a7f53168b0a03828e0cbd22938fc5a0d7e4a21a576ac42ed6625afa80b195c6218bba1e7a981ea903a6
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.coffiices.com
Port
587
Username
[email protected]
Password
E5%lCvZ{l[6

Targets

- Target
  Commercial Invoice.exe
- Size 1.5MB
- SHA256 0b65d9e11e4f234aadd99ac25f0dcd8a57063cc3f8e2e98abb7e1efa1f9ac392
- MD5 483c28edb1da9ae6d1698da1ba0052d2
- SHA1 9820fe2b1b034a720276988e4f66e349d1f057a7
- SHA512 49083f2496b1dc3d9895270beb01f5005ed451a625008a7f53168b0a03828e0cbd22938fc5a0d7e4a21a576ac42ed6625afa80b195c6218bba1e7a981ea903a6
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Drops startup file
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslakeyloggerspywarestealertrojan