agenttesla | d3bee5348b0108ed67db1d364f29d51a4b0f119cdf45e7b7c414b49e55eeb548 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Payment Notification.exe
Size 887KB
Sample210524-234bbzkfkn
SHA256 d3bee5348b0108ed67db1d364f29d51a4b0f119cdf45e7b7c414b49e55eeb548
MD5 6d8a64fa399036f825d2210cbb54862b
SHA1 719feeeb8a45f74abe6b0376090ce034e5497f14
SHA512 b8faa8cf83cb06574b3b40ebaaa60b9352bbd179de5f12d8e9ccee2b5346e0db742a1460b2cb691dbbbf39c98f12a5689d26a1799eef7265ff0890004fd070a5
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
zstcznz.org
Port
587
Username
[email protected]
Password
makonyo@2017

Targets

- Target
  Payment Notification.exe
- Size 887KB
- SHA256 d3bee5348b0108ed67db1d364f29d51a4b0f119cdf45e7b7c414b49e55eeb548
- MD5 6d8a64fa399036f825d2210cbb54862b
- SHA1 719feeeb8a45f74abe6b0376090ce034e5497f14
- SHA512 b8faa8cf83cb06574b3b40ebaaa60b9352bbd179de5f12d8e9ccee2b5346e0db742a1460b2cb691dbbbf39c98f12a5689d26a1799eef7265ff0890004fd070a5
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslakeyloggerspywarestealertrojan