agenttesla | 0ad710da3c3e74e8562e4c6cc8f2d6d8fc0da38abbde279c4fa46b1ca485d4d2 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
INDIA MUMBAI BOOKING.exe
Size 836KB
Sample210809-5sbpqewwle
SHA256 0ad710da3c3e74e8562e4c6cc8f2d6d8fc0da38abbde279c4fa46b1ca485d4d2
MD5 599b896082ffbf5e8c2719e7dc13c290
SHA1 b01cc127a88417d6484217518c06d5db45528b01
SHA512 2a1aa5f9e184606089fc88c4fd084409f360fb4849f4b6fbc38a5e0d0f1373dee00dd6846c36fbfed46246b84887819d218eff3388f89cf57a14393d74b3e524
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.scriptcopy.org
Port
587
Username
[email protected]
Password
t%K@flX5~T45

Targets

- Target
  INDIA MUMBAI BOOKING.exe
- Size 836KB
- SHA256 0ad710da3c3e74e8562e4c6cc8f2d6d8fc0da38abbde279c4fa46b1ca485d4d2
- MD5 599b896082ffbf5e8c2719e7dc13c290
- SHA1 b01cc127a88417d6484217518c06d5db45528b01
- SHA512 2a1aa5f9e184606089fc88c4fd084409f360fb4849f4b6fbc38a5e0d0f1373dee00dd6846c36fbfed46246b84887819d218eff3388f89cf57a14393d74b3e524
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslakeyloggerspywarestealertrojan