agenttesla | 5cdc13420f4812754d41158ca2015d69c2d7c903f1b00f90db14705eee8f8cc8 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Order_BC012356PDF.exe
Size 664KB
Sample210402-mfzxslhlae
SHA256 5cdc13420f4812754d41158ca2015d69c2d7c903f1b00f90db14705eee8f8cc8
MD5 805d2aa8757f45d7f5843aa225d1ef4a
SHA1 fb417f0d3b84d44b930f0bf2e214041a30d41e7b
SHA512 bc548a8345882a4f836290d3257d28d3289bf787bc4977d941798413b1e7eeed6ffb5bd01d600fe743499a50df3070e6492658e560e2867568362c1a64ce7607
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.privateemail.com
Port
587
Username
[email protected]
Password
mmm777

Targets

- Target
  Order_BC012356PDF.exe
- Size 664KB
- SHA256 5cdc13420f4812754d41158ca2015d69c2d7c903f1b00f90db14705eee8f8cc8
- MD5 805d2aa8757f45d7f5843aa225d1ef4a
- SHA1 fb417f0d3b84d44b930f0bf2e214041a30d41e7b
- SHA512 bc548a8345882a4f836290d3257d28d3289bf787bc4977d941798413b1e7eeed6ffb5bd01d600fe743499a50df3070e6492658e560e2867568362c1a64ce7607
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslakeyloggerspywarestealertrojan