agenttesla | 7468d7057a877449d84f72e49e6eb1bfed2678e6e8ef76fc4fc7dfe88e48cd4c | Triage™

Login
Reports

Overview

overview

Static

static

3

Ad_HSBC_PA...df.exe

windows10-2004-x64

Ad_HSBC_PA...df.exe

windows11-ltsc_2024-x64

Sharing

Copy URL Twitter E-mail

General

Target
18072026_0855_17072026_Ad_HSBC_PAYMENT_RECEIPT_MT103pdf.gz
Size 1.4MB
Sample260718-kvf9faew3r
SHA256 7468d7057a877449d84f72e49e6eb1bfed2678e6e8ef76fc4fc7dfe88e48cd4c
MD5 381a993827b07d77bb4d5dc06520b09a
SHA1 46e1fc90506bc2711ad9ec27bc8731668755ac3a
SHA512 ebd5cec7a0b080c256c7930faab80f98baa81374e6306e25ae099d06ada992481ec21b89ca580016e361bc92c74ce74d333f6953251c548b3377debf619e8980
SSDEEP 24576:hg+vToRLhvXG/8K7hvVBL5Jpq+uCFHkREQeUDK0lnlzLdILtnZ1pGcOPXBnety:htElhY8K7vZ5BMEQeUDK0lnllIxZ1p/8
TLSH
T13465330DF42BCF054FE6F6ADD8172748685A2570A9087CBDD09640F10D7BCA47E6CA9E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

agenttesla collection discovery keylogger persistence spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

Ad_HSBC_PAYMENT_RECEIPT_MT103pdf.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

11 signatures

300 seconds

collection discovery agenttesla keylogger persistence spyware stealer trojan

Behavioral task

behavioral2

Sample

Ad_HSBC_PAYMENT_RECEIPT_MT103pdf.exe

Resource

win11ltsc2024-20260710-en

windows11-ltsc_2024-x64

11 signatures

300 seconds

collection discovery agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot8901115160:AAFpqBSJS1iWHEv-28o3SN5HTM3-lnjsgas/

Targets

- Target
  Ad_HSBC_PAYMENT_RECEIPT_MT103pdf.exe
- Size 3.3MB
- SHA256 83ce591d7b27d20266951ffa68fa339e4b1d85e30c46b4f962feaf02b6638fd6
- MD5 3e724c812b9a4f294eb89514929c10ae
- SHA1 ea097e250612e20c37762fdd0df22c68dba58d36
- SHA512 b24bdc009f2aef70a3838abcca44ea955016456434169a35ea3628c7d3486601824be614263f9bb6afac74ea53073e4c90f9c108d0e357fb1d1896c41cfc1747
- SSDEEP 49152:rHAHVFOQRRBIu4snPOiHnbw0ZgFfg1amjvMWyR6/QTQHVfAqndzj:KjlvEWyRnQHSa
- TLSH
  T1A1F58D55ABD806F4E47AD630C9D6B332C6B1BCF70631824B0964E6CDDE735924FEA221
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery agenttesla keylogger persistence spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

collectiondiscoveryagentteslakeyloggerpersistencespywarestealertrojan

behavioral2

collectiondiscoveryagentteslakeyloggerpersistencespywarestealertrojan

© 2018-2026

Terms | Privacy