agenttesla | 27dcd9778b97a02454b9d43e22c188cbc7028367b311496b463a6f7d773e9f6f | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
PO #047428.exe
Size 1.3MB
Sample210304-x8ld7zwcps
SHA256 27dcd9778b97a02454b9d43e22c188cbc7028367b311496b463a6f7d773e9f6f
MD5 f25913deea28a4588c9b32407be1ecf7
SHA1 be7f28fae100ed884d3f7d7e4d770040663ce0db
SHA512 d2bb1583a6bc09ef1b0a77ae6c90d63e36e249b9ce7099f151e0fbee241fb09f59bb54488c112767240e4017a8abc1f6132eaf4f862f4f7eaa410c2285f9bd31
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.fabricationsystems-ug.com
Port
587
Username
[email protected]
Password
wLoCM^c3

Targets

- Target
  PO #047428.exe
- Size 1.3MB
- SHA256 27dcd9778b97a02454b9d43e22c188cbc7028367b311496b463a6f7d773e9f6f
- MD5 f25913deea28a4588c9b32407be1ecf7
- SHA1 be7f28fae100ed884d3f7d7e4d770040663ce0db
- SHA512 d2bb1583a6bc09ef1b0a77ae6c90d63e36e249b9ce7099f151e0fbee241fb09f59bb54488c112767240e4017a8abc1f6132eaf4f862f4f7eaa410c2285f9bd31
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslakeyloggerspywarestealertrojan