agenttesla | 098a05e802c5aa2b68f3db36ae9407c82a7c2dbc29eba30c38b8e056e2b7c0e2 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
HX4GJ9gL8zPbYO4 Quotation Code rfq_154965 on eSupply.exe
Size 619KB
Sample210307-hdcs4dq4s6
SHA256 098a05e802c5aa2b68f3db36ae9407c82a7c2dbc29eba30c38b8e056e2b7c0e2
MD5 9be3d9d1b90a9f2eb17edffaec176244
SHA1 05a8ceb23b4aad802b94eb81d06bb61aa4a46f2a
SHA512 4b26638c74cd32ec4234185bc5b70472a3e802c187f9d2c15e3c466c168f4df824a76ca7fcec79861eb2ec5041f644804a960dec297f04ff190c898df64a7e6a
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.renlk.me
Port
587
Username
[email protected]
Password
j*E@Hj}RaXJb

Targets

- Target
  HX4GJ9gL8zPbYO4 Quotation Code rfq_154965 on eSupply.exe
- Size 619KB
- SHA256 098a05e802c5aa2b68f3db36ae9407c82a7c2dbc29eba30c38b8e056e2b7c0e2
- MD5 9be3d9d1b90a9f2eb17edffaec176244
- SHA1 05a8ceb23b4aad802b94eb81d06bb61aa4a46f2a
- SHA512 4b26638c74cd32ec4234185bc5b70472a3e802c187f9d2c15e3c466c168f4df824a76ca7fcec79861eb2ec5041f644804a960dec297f04ff190c898df64a7e6a
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

agentteslakeyloggerspywarestealertrojan