agenttesla | 6c43ac41372f9ff91e47ffa81a9c086e16cc32014d0b6f7c4571fa31a8fecd3c | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
guluh4pYFQybxL8.exe
Size 621KB
Sample210510-c2328wtvee
SHA256 6c43ac41372f9ff91e47ffa81a9c086e16cc32014d0b6f7c4571fa31a8fecd3c
MD5 e63ed0c7946b6c89294cea0d1987b671
SHA1 c5bb5c60fc10518ba7a41b7bfe3416f926857863
SHA512 09f77190d4051ab388a3cd6d35fdeaf4b0ccf24dbac6b8db9ce8069aee0f6868eb0ed3de880915615c7523cdb9603dd71a766f86e11c03b33bc6f1d51d2d2a7f
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.iykmoreentrprise.org
Port
587
Username
[email protected]
Password
rwkWCM328

Targets

- Target
  guluh4pYFQybxL8.exe
- Size 621KB
- SHA256 6c43ac41372f9ff91e47ffa81a9c086e16cc32014d0b6f7c4571fa31a8fecd3c
- MD5 e63ed0c7946b6c89294cea0d1987b671
- SHA1 c5bb5c60fc10518ba7a41b7bfe3416f926857863
- SHA512 09f77190d4051ab388a3cd6d35fdeaf4b0ccf24dbac6b8db9ce8069aee0f6868eb0ed3de880915615c7523cdb9603dd71a766f86e11c03b33bc6f1d51d2d2a7f
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslakeyloggerspywarestealertrojan