agenttesla | aeef9ef2024eace360ddbacf7e264e90059d2afb1b0090ea94bfec5857e8f9b0 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
RFQ_SMK01042021.exe
Size 488KB
Sample210401-n9sql582e2
SHA256 aeef9ef2024eace360ddbacf7e264e90059d2afb1b0090ea94bfec5857e8f9b0
MD5 6b013cc0b60dd03612dbc238d2781d5e
SHA1 67251797fc4c2c95faba026a47b6f7851b9596da
SHA512 4c11f943661c05a3dec5d6b2fc493e0c82abc9bc6a08641c9fb134351c113356b668f917a3d4aeabfae6addb01b83dfcd7c9828bbf86d86bb72401cdf9ef78f2
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.rcs-rds.icu
Port
587
Username
[email protected]
Password
}?Sa@i3wL5uz

Targets

- Target
  RFQ_SMK01042021.exe
- Size 488KB
- SHA256 aeef9ef2024eace360ddbacf7e264e90059d2afb1b0090ea94bfec5857e8f9b0
- MD5 6b013cc0b60dd03612dbc238d2781d5e
- SHA1 67251797fc4c2c95faba026a47b6f7851b9596da
- SHA512 4c11f943661c05a3dec5d6b2fc493e0c82abc9bc6a08641c9fb134351c113356b668f917a3d4aeabfae6addb01b83dfcd7c9828bbf86d86bb72401cdf9ef78f2
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslakeyloggerspywarestealertrojan