agenttesla | e2060c79d94b735f4a9b1584d3a878bd2197959d83e0ade5f2bd6cbeefb6800b

General

Target
2026-07-12_85ad9067420980297e4881e43607c42c_agent-tesla_darkgate_elex_hawkeye_maze_remcos_xloader
Size 990KB
Sample260712-t7ncysft9w
SHA256 e2060c79d94b735f4a9b1584d3a878bd2197959d83e0ade5f2bd6cbeefb6800b
MD5 85ad9067420980297e4881e43607c42c
SHA1 786207c7b9665c88e1ac2aa690d2778310294abb
SHA512 7cb265f43af2d8a152818f752fb6544e537ce6a376e56e39c21bd5c68cb76ceb708ee4a85e903eb895dccc1907fbe0bb44a64a9f0e559d22b9de9907c203677f
SSDEEP 24576:ju6J33O0c+JY5UZ+XC0kGsoTCcZ4eK7dWY:tu0c++OCvkGsECcZ4OY
TLSH
T12A25BE2273DDC360CB669173BF69B7016EBF7C614630B85B2F880D7DA950162262D7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.antoniomayol.com:21
Port
21
Username
[email protected]
Password
cMhKDQUk1{;%

Targets

- Target
  2026-07-12_85ad9067420980297e4881e43607c42c_agent-tesla_darkgate_elex_hawkeye_maze_remcos_xloader
- Size 990KB
- SHA256 e2060c79d94b735f4a9b1584d3a878bd2197959d83e0ade5f2bd6cbeefb6800b
- MD5 85ad9067420980297e4881e43607c42c
- SHA1 786207c7b9665c88e1ac2aa690d2778310294abb
- SHA512 7cb265f43af2d8a152818f752fb6544e537ce6a376e56e39c21bd5c68cb76ceb708ee4a85e903eb895dccc1907fbe0bb44a64a9f0e559d22b9de9907c203677f
- SSDEEP 24576:ju6J33O0c+JY5UZ+XC0kGsoTCcZ4eK7dWY:tu0c++OCvkGsECcZ4OY
- TLSH
  T12A25BE2273DDC360CB669173BF69B7016EBF7C614630B85B2F880D7DA950162262D7A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery agenttesla keylogger spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Detect packed .NET executables. Mostly AgentTeslaV4.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables referencing Windows vault credential objects. Observed in infostealers
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Detects executables referencing many email and collaboration clients. Observed in information steale
- Detects executables referencing many file transfer clients. Observed in information stealers
- Drops startup file
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: AgentTesla

Detect packed .NET executables. Mostly AgentTeslaV4.

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects executables referencing Windows vault credential objects. Observed in infostealers

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

Detects executables referencing many email and collaboration clients. Observed in information steale

Detects executables referencing many file transfer clients. Observed in information stealers

Drops startup file

Executes dropped EXE

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

AutoIT Executable

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2