agenttesla | 5fa6d5ca99ca4c692ad1ade841e71ba01dd0cfba4f3c0bb40d42fc99e512f798 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
MFRG BULK ORDERSHEET 40118.Iso.zip.exe
Size 1.3MB
Sample201109-pfgc8fbghx
SHA256 5fa6d5ca99ca4c692ad1ade841e71ba01dd0cfba4f3c0bb40d42fc99e512f798
MD5 0d5feebcd0167ee465e9fc3841cc545c
SHA1 343514aeda0bb8655517c9751767632a6a3f7adc
SHA512 1a43ebc1fa571e941d389bfe2c1eca48a39447424f63742aff55a5c879cd0e539b45a357a01b19db45a3cf5a2eee374d4d70a806a22a6d343ef73417c012f141
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.mexicanproduct.com.mx
Port
587
Username
[email protected]
Password
Produccion2020.

Targets

- Target
  MFRG BULK ORDERSHEET 40118.Iso.zip.exe
- Size 1.3MB
- SHA256 5fa6d5ca99ca4c692ad1ade841e71ba01dd0cfba4f3c0bb40d42fc99e512f798
- MD5 0d5feebcd0167ee465e9fc3841cc545c
- SHA1 343514aeda0bb8655517c9751767632a6a3f7adc
- SHA512 1a43ebc1fa571e941d389bfe2c1eca48a39447424f63742aff55a5c879cd0e539b45a357a01b19db45a3cf5a2eee374d4d70a806a22a6d343ef73417c012f141
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Drops startup file
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslakeyloggerspywarestealertrojan