agenttesla | 0f79f1474853b064ba7a5b967965ada4dc58c593bf82da850959f6eb7bd8f9ca | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
remittance copy.exe
Size 1.5MB
Sample201109-vbfdz8gn5n
SHA256 0f79f1474853b064ba7a5b967965ada4dc58c593bf82da850959f6eb7bd8f9ca
MD5 8f26c626244fa00091032000105e2128
SHA1 7c484c43c873cd6a90fe9eb5d0fb45c28d1e0f7c
SHA512 f0d8acdf206209fb4982b93859649bc09a37f8349d0cd1c0475874422b9cf7b75d71e89aeb2ebe380e5374e2c76803e09255b8257917365c78fb9f284fef73d3
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.yandex.com
Port
587
Username
[email protected]
Password
genesis070

Targets

- Target
  remittance copy.exe
- Size 1.5MB
- SHA256 0f79f1474853b064ba7a5b967965ada4dc58c593bf82da850959f6eb7bd8f9ca
- MD5 8f26c626244fa00091032000105e2128
- SHA1 7c484c43c873cd6a90fe9eb5d0fb45c28d1e0f7c
- SHA512 f0d8acdf206209fb4982b93859649bc09a37f8349d0cd1c0475874422b9cf7b75d71e89aeb2ebe380e5374e2c76803e09255b8257917365c78fb9f284fef73d3
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Drops startup file
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslakeyloggerspywarestealertrojan