agenttesla | 303bac353481639b2ead5860845f621f9f70a8282e31ecd3cb5c5d3fafaeb38d | Triage

Sharing

General

Target

Ainxpfgc.exe
Size

52KB
Sample

220522-fyywfafec4
MD5

ba2258324fc45ea8d9d7d5f94f50c8f5
SHA1

7173d2dbcae0cb1725768d9127ebf159e1997238
SHA256

303bac353481639b2ead5860845f621f9f70a8282e31ecd3cb5c5d3fafaeb38d
SHA512

e1e786462374c9a0d43e4dae5b7211d2a4e59839cdeb84892e21ec643040ccd54bb393ab797fb6161ce0945200885e7717664321248714fabfce48e5f917c810

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot1884223853:AAERiJ4aER91WwDYG8sj4RQTLbHHOQX2Bf0/sendDocument

Targets

- Target
  
  Ainxpfgc.exe
- Size
  
  52KB
- MD5
  
  ba2258324fc45ea8d9d7d5f94f50c8f5
- SHA1
  
  7173d2dbcae0cb1725768d9127ebf159e1997238
- SHA256
  
  303bac353481639b2ead5860845f621f9f70a8282e31ecd3cb5c5d3fafaeb38d
- SHA512
  
  e1e786462374c9a0d43e4dae5b7211d2a4e59839cdeb84892e21ec643040ccd54bb393ab797fb6161ce0945200885e7717664321248714fabfce48e5f917c810
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

agentteslacollectionkeyloggerspywarestealertrojan

behavioral2

agentteslacollectionkeyloggerspywarestealertrojan