agenttesla | 6468ac589dea9fba80c9671c62dfe200f863ad89f4af89e9f973eebf5cf6c18c | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Shipping DOC.com
Size 1.4MB
Sample201109-qa5qwpnecn
SHA256 6468ac589dea9fba80c9671c62dfe200f863ad89f4af89e9f973eebf5cf6c18c
MD5 4beb8799750cb3265808697f30ac5d17
SHA1 dc2ee77065f45360363c5fca5bf7fa5235a67e66
SHA512 b2d6a3ae1b923682ecaf077386ea1ae1707e2cf809dd36cd8b8ccc975cd1e61fd8d4817c4cbe5fe64f97e90bb6f6f2412a15620b692aade93983384cf0b33a06
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.yandex.com
Port
587
Username
[email protected]
Password
vicanto1994

Targets

- Target
  Shipping DOC.com
- Size 1.4MB
- SHA256 6468ac589dea9fba80c9671c62dfe200f863ad89f4af89e9f973eebf5cf6c18c
- MD5 4beb8799750cb3265808697f30ac5d17
- SHA1 dc2ee77065f45360363c5fca5bf7fa5235a67e66
- SHA512 b2d6a3ae1b923682ecaf077386ea1ae1707e2cf809dd36cd8b8ccc975cd1e61fd8d4817c4cbe5fe64f97e90bb6f6f2412a15620b692aade93983384cf0b33a06
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Drops startup file
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslakeyloggerspywarestealertrojan