agenttesla | 9cf2a057f02576f4223e7c2f8ef4c217944385df4cd3180029ff96b80122d752 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
DHL Express Courier Pickup Confirmation CBJ210623122097.exe
Size 848KB
Sample210712-sqljr2bena
SHA256 9cf2a057f02576f4223e7c2f8ef4c217944385df4cd3180029ff96b80122d752
MD5 91c5d3c989f9e4f266c068d1406c233a
SHA1 59c0e91ed648eee0101752bc54b67e6dd4abfcbd
SHA512 8355467758153934069e4e34559cb64951bbd4556b752dcb55318529acfc188048a8dcc618f8b775b45e3c9ec776101b195d6cbe6943fe378450c5f22d46fdd9
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.dekjmo.com
Port
587
Username
[email protected]
Password
eidOTv$9

Targets

- Target
  DHL Express Courier Pickup Confirmation CBJ210623122097.exe
- Size 848KB
- SHA256 9cf2a057f02576f4223e7c2f8ef4c217944385df4cd3180029ff96b80122d752
- MD5 91c5d3c989f9e4f266c068d1406c233a
- SHA1 59c0e91ed648eee0101752bc54b67e6dd4abfcbd
- SHA512 8355467758153934069e4e34559cb64951bbd4556b752dcb55318529acfc188048a8dcc618f8b775b45e3c9ec776101b195d6cbe6943fe378450c5f22d46fdd9
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslakeyloggerspywarestealertrojan