agenttesla | 8fe03dc4b6ed35defdab98f794580d624ddd039c80581f92588201d3a46a8be4 | Triage™

Login
Reports

Overview

overview

Static

static

3

8fe03dc4b6...e4.exe

windows10-2004-x64

8fe03dc4b6...e4.exe

windows11-ltsc_2024-x64

Sharing

Copy URL Twitter E-mail

General

Target
8fe03dc4b6ed35defdab98f794580d624ddd039c80581f92588201d3a46a8be4.exe
Size 3.4MB
Sample260810-rfhbhswsdt
SHA256 8fe03dc4b6ed35defdab98f794580d624ddd039c80581f92588201d3a46a8be4
MD5 9492000215d7c92a61434efa1a5a6d7f
SHA1 aada93a043c4fd6953182da56031b1624473549b
SHA512 91724a7f3ab0fdec86c5cfa1211b81a1551ee7f587c154c89a68dc75634166ef88771f3a6f003b176df6f9361758d8c65016b522211aecdbedacbbec8511029a
SSDEEP 49152:5MtK6O5+7JkgRNTLCOBR7OpMSr/0U3WtHHfClA9NSclaDHnz1hcW4uuqb:HYT3DtHRlarcwb
TLSH
T12CF55B70D351B065D1A7C430CECA4EF4A4A1303B52366D1F1BC5D91A25FBEA1ABAD3A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

agenttesla collection discovery keylogger persistence spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

8fe03dc4b6ed35defdab98f794580d624ddd039c80581f92588201d3a46a8be4.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

11 signatures

150 seconds

collection discovery agenttesla keylogger persistence spyware stealer trojan

Behavioral task

behavioral2

Sample

8fe03dc4b6ed35defdab98f794580d624ddd039c80581f92588201d3a46a8be4.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

11 signatures

150 seconds

collection discovery agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol
smtp
Host
server275.web-hosting.com
Port
587
Username
[email protected]
Password
v=$W*?frF2elUk6d

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
server275.web-hosting.com
Port
587
Username
[email protected]
Password
v=$W*?frF2elUk6d
Email to
[email protected]

Targets

- Target
  8fe03dc4b6ed35defdab98f794580d624ddd039c80581f92588201d3a46a8be4.exe
- Size 3.4MB
- SHA256 8fe03dc4b6ed35defdab98f794580d624ddd039c80581f92588201d3a46a8be4
- MD5 9492000215d7c92a61434efa1a5a6d7f
- SHA1 aada93a043c4fd6953182da56031b1624473549b
- SHA512 91724a7f3ab0fdec86c5cfa1211b81a1551ee7f587c154c89a68dc75634166ef88771f3a6f003b176df6f9361758d8c65016b522211aecdbedacbbec8511029a
- SSDEEP 49152:5MtK6O5+7JkgRNTLCOBR7OpMSr/0U3WtHHfClA9NSclaDHnz1hcW4uuqb:HYT3DtHRlarcwb
- TLSH
  T12CF55B70D351B065D1A7C430CECA4EF4A4A1303B52366D1F1BC5D91A25FBEA1ABAD3A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery agenttesla keylogger persistence spyware stealer trojan
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

collectiondiscoveryagentteslakeyloggerpersistencespywarestealertrojan

behavioral2

collectiondiscoveryagentteslakeyloggerpersistencespywarestealertrojan

© 2018-2026

Terms | Privacy