agenttesla | 0dea09c30d8e850fab893b3f17f9bad6898c7e77bb690ecfe523681ca0f07e95 | Triage™

Login
Reports

Overview

overview

Static

static

MSC-BL Dra...30.exe

windows7_x64

MSC-BL Dra...30.exe

windows10_x64

Sharing

Copy URL Twitter E-mail

General

Target
MSC-BL Draft-283930.exe
Size 961KB
Sample210509-79x6fcvrb6
SHA256 0dea09c30d8e850fab893b3f17f9bad6898c7e77bb690ecfe523681ca0f07e95
MD5 3735f0c7322c169db4abe40a324f0c25
SHA1 da32f82a6137b40391a9d2883ff95b9a63b2083d
SHA512 d0295769886d80bdcd37fbd4389d07788565f1eec1e8bff23c959dae587cd1f131e93402729555e5d4189c6e9f0e8650fef04f861154a0de66b9e3da978e0938
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

MSC-BL Draft-283930.exe

Resource

win7v20210408

windows7_x64

0 signatures

0 seconds

agenttesla keylogger persistence spyware stealer trojan

Behavioral task

behavioral2

Sample

MSC-BL Draft-283930.exe

Resource

win10v20210410

windows10_x64

0 signatures

0 seconds

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
webmail.mdist.us
Port
587
Username
[email protected]
Password
Jg#4321

Targets

- Target
  MSC-BL Draft-283930.exe
- Size 961KB
- SHA256 0dea09c30d8e850fab893b3f17f9bad6898c7e77bb690ecfe523681ca0f07e95
- MD5 3735f0c7322c169db4abe40a324f0c25
- SHA1 da32f82a6137b40391a9d2883ff95b9a63b2083d
- SHA512 d0295769886d80bdcd37fbd4389d07788565f1eec1e8bff23c959dae587cd1f131e93402729555e5d4189c6e9f0e8650fef04f861154a0de66b9e3da978e0938
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Drops file in Drivers directory
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslakeyloggerpersistencespywarestealertrojan

behavioral2

agentteslakeyloggerpersistencespywarestealertrojan

© 2018-2026

Terms | Privacy