agenttesla | ce2c29bbd18352557dd6fb16e294265d66d8d13e6d0586ef8030bbeb28e0cc97 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
CORRECT INVOICE.exe
Size 528KB
Sample201126-tagkell7rs
SHA256 ce2c29bbd18352557dd6fb16e294265d66d8d13e6d0586ef8030bbeb28e0cc97
MD5 9968a84f926b882fe6d76e20678424ac
SHA1 78859dc0792f58b8a0eef20ee5eb3d82db24667c
SHA512 f732db1c908aab2d0bd2a0cb2fa607a3551021ef0483dac26eefaae67811fdd6a37b87082dae3871ae613c5240a72948d32cc3591894d1d2a3591aa2549ac72e
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.ailne-medical.com
Port
587
Username
[email protected]
Password
Pass@324dadvui

Targets

- Target
  CORRECT INVOICE.exe
- Size 528KB
- SHA256 ce2c29bbd18352557dd6fb16e294265d66d8d13e6d0586ef8030bbeb28e0cc97
- MD5 9968a84f926b882fe6d76e20678424ac
- SHA1 78859dc0792f58b8a0eef20ee5eb3d82db24667c
- SHA512 f732db1c908aab2d0bd2a0cb2fa607a3551021ef0483dac26eefaae67811fdd6a37b87082dae3871ae613c5240a72948d32cc3591894d1d2a3591aa2549ac72e
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslakeyloggerspywarestealertrojan