agenttesla | a6076e0557a744abc7f90659042e9983005b2bee26db2f3024024e43f1d5fc1d | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
e5049130d1c6bd023f5fc3f8bf8c95c5.exe
Size 951KB
Sample210428-xbel2dp2fs
SHA256 a6076e0557a744abc7f90659042e9983005b2bee26db2f3024024e43f1d5fc1d
MD5 e5049130d1c6bd023f5fc3f8bf8c95c5
SHA1 10eb3e3f9b0907d409cc2d3cadf8324c5af2c9d9
SHA512 861fb90e8fea33a1b85c18ef533fecc5ebf59fafcc5dfed1c01579fdc8667a44c0852d0dd83a2d63c5e55f71a3d3ffe7eeeda9e87c33dff124b112105e52e1fa
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot1620445910:AAF2v81NoINJsu_XXnpGet1YDm-NxnznaIE/sendDocument

Targets

- Target
  e5049130d1c6bd023f5fc3f8bf8c95c5.exe
- Size 951KB
- SHA256 a6076e0557a744abc7f90659042e9983005b2bee26db2f3024024e43f1d5fc1d
- MD5 e5049130d1c6bd023f5fc3f8bf8c95c5
- SHA1 10eb3e3f9b0907d409cc2d3cadf8324c5af2c9d9
- SHA512 861fb90e8fea33a1b85c18ef533fecc5ebf59fafcc5dfed1c01579fdc8667a44c0852d0dd83a2d63c5e55f71a3d3ffe7eeeda9e87c33dff124b112105e52e1fa
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslakeyloggerspywarestealertrojan