agenttesla | 87973e346d9cd60f9c0d975922710117bf5c7638f324415fd492829f9fca2015 | Triage™

Login
Reports

Overview

overview

Static

static

3

MV.CORNELI...df.exe

windows10-2004-x64

MV.CORNELI...df.exe

windows11-ltsc_2024-x64

Sharing

Copy URL Twitter E-mail

General

Target
18072026_0855_17072026_MV.CORNELIA M.VESSEL.MAIN.INFORMATIONpdf.z
Size 1.4MB
Sample260718-kva3eshx8s
SHA256 87973e346d9cd60f9c0d975922710117bf5c7638f324415fd492829f9fca2015
MD5 15b6f24bd7cbb5f88ccf819958d7bef3
SHA1 a6b644fce8a90232e08cc86f55f1404a287ae190
SHA512 0bc2beb30f03feeb43e9a15388ced8a0cf5b3126b284c870182e4a3120809a56d4893fb5d6a05b6515496c0d9147a11aed697d1b8bc7394df54e83e28b1e4678
SSDEEP 24576:Lg+vToRLhvXG/8K7hvVBL5Jpq+uCFHkREQeUDK0lnlzLdILtnZ1pGcOPXBneto:LtElhY8K7vZ5BMEQeUDK0lnllIxZ1p/2
TLSH
T18065330DF43BCF054FE6F6ADD8172748685A2570A9087CBDD09640F10D6BCA47E6CA5E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

agenttesla collection discovery keylogger persistence spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

MV.CORNELIA M.VESSEL.MAIN.INFORMATIONpdf.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

11 signatures

300 seconds

collection discovery agenttesla keylogger persistence spyware stealer trojan

Behavioral task

behavioral2

Sample

MV.CORNELIA M.VESSEL.MAIN.INFORMATIONpdf.exe

Resource

win11ltsc2024-20260710-en

windows11-ltsc_2024-x64

11 signatures

300 seconds

collection discovery agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot8901115160:AAFpqBSJS1iWHEv-28o3SN5HTM3-lnjsgas/

Targets

- Target
  MV.CORNELIA M.VESSEL.MAIN.INFORMATIONpdf.exe
- Size 3.3MB
- SHA256 83ce591d7b27d20266951ffa68fa339e4b1d85e30c46b4f962feaf02b6638fd6
- MD5 3e724c812b9a4f294eb89514929c10ae
- SHA1 ea097e250612e20c37762fdd0df22c68dba58d36
- SHA512 b24bdc009f2aef70a3838abcca44ea955016456434169a35ea3628c7d3486601824be614263f9bb6afac74ea53073e4c90f9c108d0e357fb1d1896c41cfc1747
- SSDEEP 49152:rHAHVFOQRRBIu4snPOiHnbw0ZgFfg1amjvMWyR6/QTQHVfAqndzj:KjlvEWyRnQHSa
- TLSH
  T1A1F58D55ABD806F4E47AD630C9D6B332C6B1BCF70631824B0964E6CDDE735924FEA221
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery agenttesla keylogger persistence spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

collectiondiscoveryagentteslakeyloggerpersistencespywarestealertrojan

behavioral2

collectiondiscoveryagentteslakeyloggerpersistencespywarestealertrojan

© 2018-2026

Terms | Privacy