agenttesla | 980d7e8b4f1b9d11267a91986c805170a460fc1456e3fb4fa7e31700382291a9 | Triage

Submit
Reports

Overview

overview

Static

static

980d7e8b4f...a9.exe

windows7-x64

980d7e8b4f...a9.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target

980d7e8b4f1b9d11267a91986c805170a460fc1456e3fb4fa7e31700382291a9.exe
Size

860KB
Sample

221010-mvh45sbfgj
MD5

ebc0c0e656eadba132cab93ce677829e
SHA1

d96b7ccbe6ab6e2ea7a1e5fead2b6f9f3e5d139c
SHA256

980d7e8b4f1b9d11267a91986c805170a460fc1456e3fb4fa7e31700382291a9
SHA512

8d31650c86c94c23c80ade53d72fb0834bf3b40f7235b0c6b7f1fdc5315ab3959c52d8f2bede06fe513d74d5bc13069d77f348143f3b5f3f233dfc750fa35f0e
SSDEEP

12288:DfFbUcOCdRCgaGUumPGtgfjF8LDbDYdYgj59Zb2pHSiz++xfatDdwFA1RmISO:DfFb4IR8dPtfWff85zCLVa82RcO

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

980d7e8b4f1b9d11267a91986c805170a460fc1456e3fb4fa7e31700382291a9.exe

Resource

win7-20220812-en

agenttesla keylogger spyware stealer trojan

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

980d7e8b4f1b9d11267a91986c805170a460fc1456e3fb4fa7e31700382291a9.exe

Resource

win10v2004-20220812-en

agenttesla collection keylogger spyware stealer trojan

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.darnfoss.com
Port:
587
Username:
[email protected]
Password:
QhMzMMh0

Targets

- Target
  
  980d7e8b4f1b9d11267a91986c805170a460fc1456e3fb4fa7e31700382291a9.exe
- Size
  
  860KB
- MD5
  
  ebc0c0e656eadba132cab93ce677829e
- SHA1
  
  d96b7ccbe6ab6e2ea7a1e5fead2b6f9f3e5d139c
- SHA256
  
  980d7e8b4f1b9d11267a91986c805170a460fc1456e3fb4fa7e31700382291a9
- SHA512
  
  8d31650c86c94c23c80ade53d72fb0834bf3b40f7235b0c6b7f1fdc5315ab3959c52d8f2bede06fe513d74d5bc13069d77f348143f3b5f3f233dfc750fa35f0e
- SSDEEP
  
  12288:DfFbUcOCdRCgaGUumPGtgfjF8LDbDYdYgj59Zb2pHSiz++xfatDdwFA1RmISO:DfFb4IR8dPtfWff85zCLVa82RcO
Score

10^/10

agenttesla keylogger spyware stealer trojan collection
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslacollectionkeyloggerspywarestealertrojan

© 2018-2025

Terms | Privacy