agenttesla | 5505773e19fa155a75c0edc2cc89e2896c40d0fa9c2a5cb9ee1b5e2c6264f8c0 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
MACHINE SPECIFICATION.exe
Size 903KB
Sample210511-kl35hh2nss
SHA256 5505773e19fa155a75c0edc2cc89e2896c40d0fa9c2a5cb9ee1b5e2c6264f8c0
MD5 c53ba5ef5fe65b2057aa69376216ccc9
SHA1 a9683343c90a93f379702ddd6256ac66815da8e7
SHA512 9006558b5ed640c057010377571548981aaab6ce5c9569ca30f9f128ae2556419a611168c9de80fbc48ee0ed3d1383995d39c885ae4d90217d8c5e825292d167
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.ieaspk.com/
Port
21
Username
[email protected]
Password
3%*A_tO)HxX@

Targets

- Target
  MACHINE SPECIFICATION.exe
- Size 903KB
- SHA256 5505773e19fa155a75c0edc2cc89e2896c40d0fa9c2a5cb9ee1b5e2c6264f8c0
- MD5 c53ba5ef5fe65b2057aa69376216ccc9
- SHA1 a9683343c90a93f379702ddd6256ac66815da8e7
- SHA512 9006558b5ed640c057010377571548981aaab6ce5c9569ca30f9f128ae2556419a611168c9de80fbc48ee0ed3d1383995d39c885ae4d90217d8c5e825292d167
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslakeyloggerspywarestealertrojan