agenttesla | 3c8a0782ff5a7ba09544975711f5f4bf170b915ae595b126b867c422896526bc | Triage

Sharing

General

Target

SWIFT.exe
Size

770KB
Sample

240429-lesszaff2y
MD5

c29c58020cff52461dc863a695468a80
SHA1

8e43e2d6bd4f419deb574b73896201eaa5579da9
SHA256

3c8a0782ff5a7ba09544975711f5f4bf170b915ae595b126b867c422896526bc
SHA512

1db35b0783f46ec009378088691a6fdcd6e025ec3cdc0ff1b2ee4b932d713f6f6cfa6e830c1fd95cc710c85fba6cea7d5ab099efd8196eff37a9205b899266cc
SSDEEP

12288:SF2iNZv47vkaRwtIL1VONHrr1To46r0FdfKI9ZFEEwElv312Z3ag+h:SF1Pg7vkMnLHC9U46rMLkEJ312ZZ+

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.quoctoan.vn
Port:
587
Username:
[email protected]
Password:
bGMJNaGYNTLC
Email To:
[email protected]

Targets

- Target
  
  SWIFT.exe
- Size
  
  770KB
- MD5
  
  c29c58020cff52461dc863a695468a80
- SHA1
  
  8e43e2d6bd4f419deb574b73896201eaa5579da9
- SHA256
  
  3c8a0782ff5a7ba09544975711f5f4bf170b915ae595b126b867c422896526bc
- SHA512
  
  1db35b0783f46ec009378088691a6fdcd6e025ec3cdc0ff1b2ee4b932d713f6f6cfa6e830c1fd95cc710c85fba6cea7d5ab099efd8196eff37a9205b899266cc
- SSDEEP
  
  12288:SF2iNZv47vkaRwtIL1VONHrr1To46r0FdfKI9ZFEEwElv312Z3ag+h:SF1Pg7vkMnLHC9U46rMLkEJ312ZZ+
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslakeyloggerspywarestealertrojan