agenttesla | 771c4c5692edbc7ce3294da2fc8e208dfd786ff83ba7751cf4ed0dd01625facb | Triage

Sharing

General

Target

771c4c5692edbc7ce3294da2fc8e208dfd786ff83ba7751cf4ed0dd01625facb
Size

915KB
Sample

240521-cdvrhaee36
MD5

9bf406057f6cdf40f4a6e505586e848f
SHA1

6c8e3ab212b34c080d44a08eae8ead9863deecc1
SHA256

771c4c5692edbc7ce3294da2fc8e208dfd786ff83ba7751cf4ed0dd01625facb
SHA512

b726dbd79dd0474fcb96fb6a6a9884357a0edb56ebcddf53804eeed534d1f370977c3eca120f02210bc1dbcb7effb269efa4e4a2ceb3f770cc370567f09afcf3
SSDEEP

24576:CnvC6OMR5zdt6ATWEr4TaMeZWCBXgvllxeG1IdvSa4SbPHS3gDo:XELLD6Er4mMeW950vd4SbPygDo

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
associatessystems.com
Port:
21
Username:
[email protected]
Password:
computer1840

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Port:
587
Username:
ftp://[email protected]
Password:
[email protected]

Targets

- Target
  
  sample order quotation.exe
- Size
  
  1.4MB
- MD5
  
  726c360beafc5735df3048301fccc5b9
- SHA1
  
  3b9c9c07bfd564ddad935778a24e2c93f8883457
- SHA256
  
  d91abe1f2c3533430178d0067ffc5ce588d2bd241375179829179c82d39d9e6d
- SHA512
  
  cac48ab2f722d845bba623f80dcd0856b651e3ec46695dc4efa4f7cbd94d8d877d581001b6d32d14f16628787636537753c418dc27d27e07a5ad2ae6d3c8b9fa
- SSDEEP
  
  24576:8yLNKjUF+x7f5H6s5K+zzLZYaQer4C/RYhhlBk+hIHDSYWORpHc3gpJ:m8IzLZ9Q04lLOD5WORpkgpJ
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslakeyloggerspywarestealertrojan