agenttesla | SecuriteInfo[.]com[.]BackDoor[.]SpyBotNET[.]25[.]28952[.]28107 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
SecuriteInfo.com.BackDoor.SpyBotNET.25.28952.28107
Size 216KB
Sample201123-dazegmt75a
SHA256 755609ffa45b84235de59f8c546c2c2f5e95e40e3ca6df1eca35adcd47b2f7ba
MD5 2aa72d8ddee42fde91878cffe0ac139e
SHA1 c0a16b1e80741892b795bec191a0b3a897f5a10b
SHA512 0bfe257fdfd50b5012e2d148910b44c4bf6fc10138c28215886d7e8ed8dc66b73a92a11ff8c358f1c00989b87ab595402fe1803692c9e2ae835b6b7ad5e146e8
MD5 SHA1 SHA512

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.quicksaefreight-ae.com
Port
587
Username
[email protected]
Password
*NYssK(0

Signatures

AgentTesla Payload 1 IoCs

resource	yara_rule
sample	family_agenttesla

Agenttesla family
agenttesla

File Explorer

SecuriteInfo.com.BackDoor.SpyBotNET.25.28952.28107

.exe 216KB

SecuriteInfo.com.BackDoor.SpyBotNET.25.28952.28107

SHA256 755609ffa45b84235de59f8c546c2c2f5e95e40e3ca6df1eca35adcd47b2f7ba
MD5 2aa72d8ddee42fde91878cffe0ac139e
SHA1 c0a16b1e80741892b795bec191a0b3a897f5a10b
SHA512 0bfe257fdfd50b5012e2d148910b44c4bf6fc10138c28215886d7e8ed8dc66b73a92a11ff8c358f1c00989b87ab595402fe1803692c9e2ae835b6b7ad5e146e8
MD5 SHA1 SHA512

windows x86

AgentTesla Payload