agenttesla | aa8858f450d41fa1c9bade302c7d5f008f5abdb54cc3c048df93fdbfc8d24b07 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
PR#68478.exe
Size 1.8MB
Sample201109-pvfc59l71s
SHA256 aa8858f450d41fa1c9bade302c7d5f008f5abdb54cc3c048df93fdbfc8d24b07
MD5 2c040ef11836d62addc57d7074df27f4
SHA1 81412c3839c40c714fce85bcc9f0ccce0c3100f3
SHA512 fce315b56d0b526cf952bdb6f2ac2e85273698335f18f261987a3a79ae9cd3eb0fb3bbdc343a27b9878bdcc57f21a945bc6728d088b703ef820a113155ce5359
MD5 SHA1 SHA512

Score

10^/10

agenttesla nanocore keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.dressmartintl.com
Port
587
Username
[email protected]
Password
Dress@2020

Targets

- Target
  PR#68478.exe
- Size 1.8MB
- SHA256 aa8858f450d41fa1c9bade302c7d5f008f5abdb54cc3c048df93fdbfc8d24b07
- MD5 2c040ef11836d62addc57d7074df27f4
- SHA1 81412c3839c40c714fce85bcc9f0ccce0c3100f3
- SHA512 fce315b56d0b526cf952bdb6f2ac2e85273698335f18f261987a3a79ae9cd3eb0fb3bbdc343a27b9878bdcc57f21a945bc6728d088b703ef820a113155ce5359
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan nanocore
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- AgentTesla Payload
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslananocorekeyloggerspywarestealertrojan