agenttesla | a944f09589ba97e55ee91de25b37708a24d1fed73b3b9af848d5ea8fa097f89c | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Jan 2022 Last Order -1102990_DOC_00902011.PDF.exe
Size 544KB
Sample220131-k9nbashed2
SHA256 a944f09589ba97e55ee91de25b37708a24d1fed73b3b9af848d5ea8fa097f89c
MD5 539b638382735350da38900a8d1eb22b
SHA1 cc24e6fdf7cf85f7b783ec842d85e9333408811c
SHA512 35763a029388f20e312d5a537b2a64c83736b9ba20d3db274b9f2d4091ba262a0e4e19051e5cdccfbcae16e61c9250c100b0f5f203198470e8c9e673bb277432
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.byblosbank-iq.com
Port
587
Username
[email protected]
Password
sync@#1235

Targets

- Target
  Jan 2022 Last Order -1102990_DOC_00902011.PDF.exe
- Size 544KB
- SHA256 a944f09589ba97e55ee91de25b37708a24d1fed73b3b9af848d5ea8fa097f89c
- MD5 539b638382735350da38900a8d1eb22b
- SHA1 cc24e6fdf7cf85f7b783ec842d85e9333408811c
- SHA512 35763a029388f20e312d5a537b2a64c83736b9ba20d3db274b9f2d4091ba262a0e4e19051e5cdccfbcae16e61c9250c100b0f5f203198470e8c9e673bb277432
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslakeyloggerspywarestealertrojan