agenttesla | 23419d1f783c90e855cd52aaa46ddc97e06f2514dbaf6abf69f1aec24c279fe6 | Triage

Sharing

General

Target

hesaphareketi-20-12-2024-pdf.exe
Size

5.0MB
Sample

241220-scqn6aynbm
MD5

1cb211d3d1aead7eb34777c5d76695da
SHA1

5d61854d0be9ba2360f721cb79c3b06c07e59106
SHA256

23419d1f783c90e855cd52aaa46ddc97e06f2514dbaf6abf69f1aec24c279fe6
SHA512

907dc967e6c94d530d42029ee0e18f2ae154a16c45d7d184c78ebc1be8c8213fa9326ec8f8d9f428c46d4b99fef229ee976e1bebb8dfa9d84d980d60d09df23b
SSDEEP

49152:P1oF4Lbr1B1q3SlFQE/6L6hkOITCygj4FITzZGtQprMpyZxE6MKd1rxgwcqyssdN:P1Fr1Ba5LJ2zZN31UQ2pgPK+g

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.normagroup.com.tr
Port:
21
Username:
[email protected]
Password:
Qb.X[.j.Yfm[

Targets

- Target
  
  hesaphareketi-20-12-2024-pdf.exe
- Size
  
  5.0MB
- MD5
  
  1cb211d3d1aead7eb34777c5d76695da
- SHA1
  
  5d61854d0be9ba2360f721cb79c3b06c07e59106
- SHA256
  
  23419d1f783c90e855cd52aaa46ddc97e06f2514dbaf6abf69f1aec24c279fe6
- SHA512
  
  907dc967e6c94d530d42029ee0e18f2ae154a16c45d7d184c78ebc1be8c8213fa9326ec8f8d9f428c46d4b99fef229ee976e1bebb8dfa9d84d980d60d09df23b
- SSDEEP
  
  49152:P1oF4Lbr1B1q3SlFQE/6L6hkOITCygj4FITzZGtQprMpyZxE6MKd1rxgwcqyssdN:P1Fr1Ba5LJ2zZN31UQ2pgPK+g
Score

10^/10

agenttesla discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agenttesladiscoverykeyloggerspywarestealertrojan

behavioral2

agenttesladiscoverykeyloggerspywarestealertrojan