agenttesla | 577d4a686110fac3e636d9aa40e4cf4b8234f8fb87a7b584ee9558496c3bf1aa | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
BILL OF LANDING DRAFT. COMMERCIAL INVOICE SHIPMENT 709447464231.pdf.7z
Size 475KB
Sample210413-21fy2ey8we
SHA256 577d4a686110fac3e636d9aa40e4cf4b8234f8fb87a7b584ee9558496c3bf1aa
MD5 c87932c9689f5c2cc0f35d183776e317
SHA1 ccb00f9db48884ba2f651169e2b9bbe1539acddc
SHA512 26cf68683eafa1a14b7cadccee033b65edf800c896d7f911cbde5c2f49336c1716ab9f28b2c9abf95e2913f339d0fd2e9cd42c0e3889eb10afe0db211b1a8fb1
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.kocelayakkabi.com
Port
587
Username
[email protected]
Password
*42aykent_?kocel

Targets

- Target
  BILL OF LANDING DRAFT. COMMERCIAL INVOICE SHIPMENT 709447464231.pdf.exe
- Size 633KB
- SHA256 c3ccb5a810da4cb19a71c1fa9edf8096263cc55c00341287b8c8203b8da1e939
- MD5 0fee40db6b3f27865316a06549dd96b5
- SHA1 217d155f1a0358e7a5ea87b21cf7e510f988d7c7
- SHA512 8e150029920ce58f804bc2cd5ebe881beeceba37f12a8efc56eae523e98b85e008140e25a57f205dc5cef437e1e0210f348e22109d521c59ec5846d9a5ca4640
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

agentteslakeyloggerspywarestealertrojan