agenttesla | 7bcd067c0a67a7a6e2c3f3079b626afb4f9ab1b8643b50dce1a69cd94fdab4ee | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
New Order PO#109355______pdf_________.exe
Size 1.7MB
Sample210513-xea98tfhfa
SHA256 7bcd067c0a67a7a6e2c3f3079b626afb4f9ab1b8643b50dce1a69cd94fdab4ee
MD5 a768a5a11d5a3b006b79fa65a9e93768
SHA1 0748925d39907166cdb3796398c41d1bd9f7dd91
SHA512 17d14fa1c5d71aa5f0cbd208ddd5564cfeb759ef0b60eb51bb3cac4810387a1e78b7396751a2c91fd9180fb641211d220c90f886b4f7fdfbd8291a62aec66a01
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.lokalboyz.com
Port
587
Username
[email protected]
Password
lkEb6ovn

Targets

- Target
  New Order PO#109355______pdf_________.exe
- Size 1.7MB
- SHA256 7bcd067c0a67a7a6e2c3f3079b626afb4f9ab1b8643b50dce1a69cd94fdab4ee
- MD5 a768a5a11d5a3b006b79fa65a9e93768
- SHA1 0748925d39907166cdb3796398c41d1bd9f7dd91
- SHA512 17d14fa1c5d71aa5f0cbd208ddd5564cfeb759ef0b60eb51bb3cac4810387a1e78b7396751a2c91fd9180fb641211d220c90f886b4f7fdfbd8291a62aec66a01
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslakeyloggerspywarestealertrojan