agenttesla | a824ba1ba2f64dee5c692f3379c18534644c013ea68c642ad0b1c7b6793a90fc | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
PO300005466.exe
Size 667KB
Sample210907-ktap9sfecm
SHA256 a824ba1ba2f64dee5c692f3379c18534644c013ea68c642ad0b1c7b6793a90fc
MD5 75265c651a45672db3c92a6f6d2e2b4c
SHA1 2f0bd956e18b40f4757a0d130eb9936a03f89d0e
SHA512 c76df6f264111455c59277afd0fdcb2e8695bd79c3df99934e007d3603a0ec231f93685ec5cfdb21a1cd01380c64b77ae425f9c2b1000e893777910e5f14c6fe
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.tccinfaes.com
Port
587
Username
[email protected]
Password
TccBps1427log

Targets

- Target
  PO300005466.exe
- Size 667KB
- SHA256 a824ba1ba2f64dee5c692f3379c18534644c013ea68c642ad0b1c7b6793a90fc
- MD5 75265c651a45672db3c92a6f6d2e2b4c
- SHA1 2f0bd956e18b40f4757a0d130eb9936a03f89d0e
- SHA512 c76df6f264111455c59277afd0fdcb2e8695bd79c3df99934e007d3603a0ec231f93685ec5cfdb21a1cd01380c64b77ae425f9c2b1000e893777910e5f14c6fe
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslakeyloggerspywarestealertrojan