agenttesla | ba9013c23988b787a28abf3dc0c0f1599372967e4bd9b7abd24280180d5843ba | Triage

Sharing

Copy URL Twitter E-mail

General

Target

SecuriteInfo.com.Win32.PWSX-gen.28612.6987.exe
Size

560KB
Sample

221201-f67hjscg3v
MD5

a406b82659bc78965cff6130e93db70d
SHA1

ac86fda6813c5ba358903e64df728b5c8f6c7267
SHA256

ba9013c23988b787a28abf3dc0c0f1599372967e4bd9b7abd24280180d5843ba
SHA512

f769f7f3c3b1f04bdad051bc8830bf79aaf357f1e23dc4b594d5e4e6e88864a6b6a32ee8b6302026df219b6c80395331f3fa66b6da9f0d677b5d7a7eacd9183f
SSDEEP

12288:aoFGNrOvbcnaLJbLkh2Iql5pB3+iEkxw3ir9jq:/gNOvbcnaLJbLkfgpt+izC29j

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.otagtepetipmerkezi.com
Port:
587
Username:
[email protected]
Password:
Otm981*.

Targets

- Target
  
  SecuriteInfo.com.Win32.PWSX-gen.28612.6987.exe
- Size
  
  560KB
- MD5
  
  a406b82659bc78965cff6130e93db70d
- SHA1
  
  ac86fda6813c5ba358903e64df728b5c8f6c7267
- SHA256
  
  ba9013c23988b787a28abf3dc0c0f1599372967e4bd9b7abd24280180d5843ba
- SHA512
  
  f769f7f3c3b1f04bdad051bc8830bf79aaf357f1e23dc4b594d5e4e6e88864a6b6a32ee8b6302026df219b6c80395331f3fa66b6da9f0d677b5d7a7eacd9183f
- SSDEEP
  
  12288:aoFGNrOvbcnaLJbLkh2Iql5pB3+iEkxw3ir9jq:/gNOvbcnaLJbLkfgpt+izC29j
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslakeyloggerspywarestealertrojan