agenttesla

General

Target
d599cd22b34287261efa52b26e4ba1e7c94b31e0f06994a68ce60fe8b9cbbeec.exe
Size 601KB
Sample260205-sdmc5agw8h
SHA256 d599cd22b34287261efa52b26e4ba1e7c94b31e0f06994a68ce60fe8b9cbbeec
MD5 6a2da82769a5dde704ca3c1ce04c3ed0
SHA1 1b48b65bbe0bb703a45752d95c18cd81da6f3e56
SHA512 7a9537ec6cd07927b90e36cf8d87c10d1ad7e4840e33a1c9fc712c83879bffa4490b256c8a9a2765be1f43e8b32028862955afbd389ef575555565ec4616120f
SSDEEP 12288:zz7hU5I5yuNHIgzSFKxWltRohBfSTso93UwDhA9/UXwVYGU3/8PqT:zf+iN57Gtene3lzkyT
TLSH
T186D4234655C1AC65E25073328432CC908E3C3D71AE22676F8759F17FA8B4387EA7A74E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.cottondreams.org
Port
587
Username
[email protected]
Password
Payday2025
Email to
[email protected]

Targets

- Target
  d599cd22b34287261efa52b26e4ba1e7c94b31e0f06994a68ce60fe8b9cbbeec.exe
- Size 601KB
- SHA256 d599cd22b34287261efa52b26e4ba1e7c94b31e0f06994a68ce60fe8b9cbbeec
- MD5 6a2da82769a5dde704ca3c1ce04c3ed0
- SHA1 1b48b65bbe0bb703a45752d95c18cd81da6f3e56
- SHA512 7a9537ec6cd07927b90e36cf8d87c10d1ad7e4840e33a1c9fc712c83879bffa4490b256c8a9a2765be1f43e8b32028862955afbd389ef575555565ec4616120f
- SSDEEP 12288:zz7hU5I5yuNHIgzSFKxWltRohBfSTso93UwDhA9/UXwVYGU3/8PqT:zf+iN57Gtene3lzkyT
- TLSH
  T186D4234655C1AC65E25073328432CC908E3C3D71AE22676F8759F17FA8B4387EA7A74E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery agenttesla keylogger spyware stealer trojan upx
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Agenttesla family

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2