agenttesla | d91abe1f2c3533430178d0067ffc5ce588d2bd241375179829179c82d39d9e6d | Triage

Sharing

General

Target

d91abe1f2c3533430178d0067ffc5ce588d2bd241375179829179c82d39d9e6d.exe
Size

1.4MB
Sample

240522-vv3gsaac65
MD5

726c360beafc5735df3048301fccc5b9
SHA1

3b9c9c07bfd564ddad935778a24e2c93f8883457
SHA256

d91abe1f2c3533430178d0067ffc5ce588d2bd241375179829179c82d39d9e6d
SHA512

cac48ab2f722d845bba623f80dcd0856b651e3ec46695dc4efa4f7cbd94d8d877d581001b6d32d14f16628787636537753c418dc27d27e07a5ad2ae6d3c8b9fa
SSDEEP

24576:8yLNKjUF+x7f5H6s5K+zzLZYaQer4C/RYhhlBk+hIHDSYWORpHc3gpJ:m8IzLZ9Q04lLOD5WORpkgpJ

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
associatessystems.com
Port:
21
Username:
[email protected]
Password:
computer1840

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Port:
587
Username:
ftp://[email protected]
Password:
[email protected]

Targets

- Target
  
  d91abe1f2c3533430178d0067ffc5ce588d2bd241375179829179c82d39d9e6d.exe
- Size
  
  1.4MB
- MD5
  
  726c360beafc5735df3048301fccc5b9
- SHA1
  
  3b9c9c07bfd564ddad935778a24e2c93f8883457
- SHA256
  
  d91abe1f2c3533430178d0067ffc5ce588d2bd241375179829179c82d39d9e6d
- SHA512
  
  cac48ab2f722d845bba623f80dcd0856b651e3ec46695dc4efa4f7cbd94d8d877d581001b6d32d14f16628787636537753c418dc27d27e07a5ad2ae6d3c8b9fa
- SSDEEP
  
  24576:8yLNKjUF+x7f5H6s5K+zzLZYaQer4C/RYhhlBk+hIHDSYWORpHc3gpJ:m8IzLZ9Q04lLOD5WORpkgpJ
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslakeyloggerspywarestealertrojan