agenttesla | 2d7312010d890025b8e61e9ed20a7e0fa79d5c97a19ddee26d7be69abaa97ca2 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ORDER_SA.EXE
Size 737KB
Sample210722-ba11e2cs8j
SHA256 2d7312010d890025b8e61e9ed20a7e0fa79d5c97a19ddee26d7be69abaa97ca2
MD5 2567be7ed91809c33f43f1a37a3eb1ad
SHA1 0f8900de0a25353089e96e2c0c10d7f6742abd77
SHA512 5885dc0b6641660cb58270525c2467e92a7dfcf8dfdc6b7cbc5055ac97991d50c9ee333721356c37044a5b84d53f2e704ccede63b7555d5e0704d5a2d5769e4e
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.efm.de
Port
587
Username
[email protected]
Password
vb#8rot

Targets

- Target
  ORDER_SA.EXE
- Size 737KB
- SHA256 2d7312010d890025b8e61e9ed20a7e0fa79d5c97a19ddee26d7be69abaa97ca2
- MD5 2567be7ed91809c33f43f1a37a3eb1ad
- SHA1 0f8900de0a25353089e96e2c0c10d7f6742abd77
- SHA512 5885dc0b6641660cb58270525c2467e92a7dfcf8dfdc6b7cbc5055ac97991d50c9ee333721356c37044a5b84d53f2e704ccede63b7555d5e0704d5a2d5769e4e
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslakeyloggerspywarestealertrojan