agenttesla | ab0ffcb1f044952bf2d71c463e4a2858905c974b6302cab8e8b29d81fc268def | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Purchase Order89.exe
Size 902KB
Sample210429-kmbppj7r1a
SHA256 ab0ffcb1f044952bf2d71c463e4a2858905c974b6302cab8e8b29d81fc268def
MD5 e866ca46f6ce4cb75fcf9470236b0b13
SHA1 d0f68436a7dfea84da2b6b7af70bac36df6ffadb
SHA512 e23e9baab8a2cda228ec0c9dff234df995d104c3d2828a757e9937eae2eba38aa5c8e530241696d998063109aeab9575dc1da7b899c3ab4a0bd528d75018adb9
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.skintechpharmgroup.com
Port
587
Username
[email protected]
Password
RUT!ZR^9

Targets

- Target
  Purchase Order89.exe
- Size 902KB
- SHA256 ab0ffcb1f044952bf2d71c463e4a2858905c974b6302cab8e8b29d81fc268def
- MD5 e866ca46f6ce4cb75fcf9470236b0b13
- SHA1 d0f68436a7dfea84da2b6b7af70bac36df6ffadb
- SHA512 e23e9baab8a2cda228ec0c9dff234df995d104c3d2828a757e9937eae2eba38aa5c8e530241696d998063109aeab9575dc1da7b899c3ab4a0bd528d75018adb9
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslakeyloggerspywarestealertrojan