agenttesla | 0bad4225836db30f6301e890e4da0fe01d9178cabf7be6f62bdfa4f590050346 | Triage™

Login
Reports

Overview

overview

Static

static

PR-009848.exe

windows7-x64

PR-009848.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target
PR-009848.exe
Size 379KB
Sample220927-nte7jaeecm
SHA256 0bad4225836db30f6301e890e4da0fe01d9178cabf7be6f62bdfa4f590050346
MD5 1d331340b05f57913bb0724a15bb75b9
SHA1 52e32d5e69e55684fc910c3ce2848a8e77a1ff71
SHA512 25ff4a35a337aa2b091aaecfc94afc9d0fe27a48faafce3597eed86664a2f080c482e753b7fdd6c22046129ec74512f39ac952c3d18f7352be89042e7e1fb9ef
SSDEEP 3072:zh8qBAoB+ptSQ3gD9VVCEqr4nu7TGF0MFCfaKxJldfD/kP/Zo0/hRwRygkO8g9/y:VAyQm9VVCSz5yaKxj1D8PR1fJShKi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

PR-009848.exe

Resource

win7-20220812-en

windows7-x64

8 signatures

150 seconds

agenttesla collection keylogger spyware stealer trojan

Behavioral task

behavioral2

Sample

PR-009848.exe

Resource

win10v2004-20220812-en

windows10-2004-x64

8 signatures

150 seconds

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol
ftp
Host
ftp.lansol.com
Port
21
Username
[email protected]
Password
@t6cIop2jJgW

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.lansol.com
Port
21
Username
[email protected]
Password
@t6cIop2jJgW

Targets

- Target
  PR-009848.exe
- Size 379KB
- SHA256 0bad4225836db30f6301e890e4da0fe01d9178cabf7be6f62bdfa4f590050346
- MD5 1d331340b05f57913bb0724a15bb75b9
- SHA1 52e32d5e69e55684fc910c3ce2848a8e77a1ff71
- SHA512 25ff4a35a337aa2b091aaecfc94afc9d0fe27a48faafce3597eed86664a2f080c482e753b7fdd6c22046129ec74512f39ac952c3d18f7352be89042e7e1fb9ef
- SSDEEP 3072:zh8qBAoB+ptSQ3gD9VVCEqr4nu7TGF0MFCfaKxJldfD/kP/Zo0/hRwRygkO8g9/y:VAyQm9VVCSz5yaKxj1D8PR1fJShKi
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslacollectionkeyloggerspywarestealertrojan

behavioral2

agentteslacollectionkeyloggerspywarestealertrojan

© 2018-2026

Terms | Privacy