agenttesla | 858d78e45567e3b39affd12795d7b16fbc9af5d725ee7a0dffc10a86ca22133d | Triage™

Login
Reports

Overview

overview

Static

static

3

shipping d...ts.exe

windows7-x64

shipping d...ts.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target
shipping documents.exe
Size 463KB
Sample230425-ts3jbsdc91
SHA256 858d78e45567e3b39affd12795d7b16fbc9af5d725ee7a0dffc10a86ca22133d
MD5 1572bb732795b09ce8469e615ffb010d
SHA1 ccfa832de9028ab78dd2d9554e8b8d95b275bc9c
SHA512 581e68da17ed09656d5e522e5ff7f8507885eff7975c4a6177df21d9e27162704dd02e55beb62f056fd6cfaa0229996ed99e4aee99cb72bbaf3c0c42c324825b
SSDEEP 12288:l7cfm2Ib++4UWomGiUjcI0tlgx21XfR8d6:lQObH4rdNI0K2hfS6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

shipping documents.exe

Resource

win7-20230220-en

windows7-x64

8 signatures

150 seconds

agenttesla collection keylogger spyware stealer trojan

Behavioral task

behavioral2

Sample

shipping documents.exe

Resource

win10v2004-20230220-en

windows10-2004-x64

8 signatures

150 seconds

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.lubdub.com
Port
587
Username
[email protected]
Password
J-y!2e_fWMH_XP8F_008
Email to
[email protected]

Targets

- Target
  shipping documents.exe
- Size 463KB
- SHA256 858d78e45567e3b39affd12795d7b16fbc9af5d725ee7a0dffc10a86ca22133d
- MD5 1572bb732795b09ce8469e615ffb010d
- SHA1 ccfa832de9028ab78dd2d9554e8b8d95b275bc9c
- SHA512 581e68da17ed09656d5e522e5ff7f8507885eff7975c4a6177df21d9e27162704dd02e55beb62f056fd6cfaa0229996ed99e4aee99cb72bbaf3c0c42c324825b
- SSDEEP 12288:l7cfm2Ib++4UWomGiUjcI0tlgx21XfR8d6:lQObH4rdNI0K2hfS6
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslacollectionkeyloggerspywarestealertrojan

behavioral2

agentteslacollectionkeyloggerspywarestealertrojan

© 2018-2026

Terms | Privacy