agenttesla | 57718d0c12616f51300a8fba196989b876810e94cc14e561da218f5472a44d11 | Triage™

Login
Reports

Overview

overview

Static

static

FedEx Ship...nt.exe

windows7-x64

FedEx Ship...nt.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target
FedEx Shipping Document.exe
Size 857KB
Sample230127-ry5vjabf86
SHA256 57718d0c12616f51300a8fba196989b876810e94cc14e561da218f5472a44d11
MD5 019ef72776e9e3c81cf7250992f8b87f
SHA1 abd17d184ceb32692c36e9007612d6d15bd30ec8
SHA512 8a24bab4b32e3d47029c43d2a363a5ab839ea8a50ad30d1cdc86188e4a72919303d316d5b156c0a4ee5dfcdd8fb95e9e518c1b27ee17bdf0ba368283b7f25b52
SSDEEP 12288:ti/Y4ZHvWE1JSVc6mkVav5z9wi5++4/oigcoKc3dbaZuw66SGahRNQosT1qRbWzI:ti/LZHvno+BzWS++4Qig3dYuwOaIRSz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

FedEx Shipping Document.exe

Resource

win7-20220812-en

windows7-x64

6 signatures

150 seconds

agenttesla keylogger spyware stealer trojan

Behavioral task

behavioral2

Sample

FedEx Shipping Document.exe

Resource

win10v2004-20220901-en

windows10-2004-x64

9 signatures

150 seconds

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5015424630:AAHYFU1sKtYqSORHBErFCWNjJz1TpXKj30w/sendDocument

Targets

- Target
  FedEx Shipping Document.exe
- Size 857KB
- SHA256 57718d0c12616f51300a8fba196989b876810e94cc14e561da218f5472a44d11
- MD5 019ef72776e9e3c81cf7250992f8b87f
- SHA1 abd17d184ceb32692c36e9007612d6d15bd30ec8
- SHA512 8a24bab4b32e3d47029c43d2a363a5ab839ea8a50ad30d1cdc86188e4a72919303d316d5b156c0a4ee5dfcdd8fb95e9e518c1b27ee17bdf0ba368283b7f25b52
- SSDEEP 12288:ti/Y4ZHvWE1JSVc6mkVav5z9wi5++4/oigcoKc3dbaZuw66SGahRNQosT1qRbWzI:ti/LZHvno+BzWS++4Qig3dYuwOaIRSz
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla keylogger spyware stealer trojan collection
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslacollectionkeyloggerspywarestealertrojan

© 2018-2026

Terms | Privacy