agenttesla | 9550766fd28f726271b31d179f082c0cc1b95b331d65d9161ccfb96c4b42ed6b | Triage™

Login
Reports

Overview

overview

Static

static

Payment_Advice.exe

windows7_x64

Payment_Advice.exe

windows10_x64

Sharing

Copy URL Twitter E-mail

General

Target
Payment_Advice.zip
Size 709KB
Sample210412-hms41ll1ea
SHA256 9550766fd28f726271b31d179f082c0cc1b95b331d65d9161ccfb96c4b42ed6b
MD5 89e6403280d5500d8644f70b688f74e7
SHA1 b8f62688cbb40c76b9c63551d8a040d5d5bd7215
SHA512 982953eac451b9a423bfea14aff6e08b3fb545f497e4f345916b6448b0591cccf0cae37df3fc0669c301c2641e2983252d063357682ba97fb3dd99723ad964b4
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

Payment_Advice.exe

Resource

win7v20210408

windows7_x64

0 signatures

0 seconds

agenttesla keylogger persistence spyware stealer trojan

Behavioral task

behavioral2

Sample

Payment_Advice.exe

Resource

win10v20210410

windows10_x64

0 signatures

0 seconds

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.upgcambodia.com
Port
587
Username
[email protected]
Password
stock3168

Targets

- Target
  Payment_Advice.exe
- Size 804KB
- SHA256 5def20f9a9f1c413c8bc154ba4a53d7d9a6cfedf4a8a84a342354dab99b12e3f
- MD5 34b849047346eb54c22d71d0fd514eed
- SHA1 da11f8037c11febf25115745a2b6e4b3066b3b5a
- SHA512 836d89df9e3be5a08af7b71e07c971ac83e1d2e97f618a977e95a7851e20fc473cd8a30dbf5bda4b044f107a5b04dfdb24f3c7e92f29a38cf89c4443b11fd18d
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Drops file in Drivers directory
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslakeyloggerpersistencespywarestealertrojan

behavioral2

agentteslakeyloggerpersistencespywarestealertrojan

© 2018-2026

Terms | Privacy