agenttesla | 64613e9558bf51f7c56f7e3f7a7d770e87859e8a8bac31a67c6dab53c59d53d5 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
PO #30114.exe
Size 121KB
Sample220208-kep7eaehal
SHA256 64613e9558bf51f7c56f7e3f7a7d770e87859e8a8bac31a67c6dab53c59d53d5
MD5 294b7c06479a50f7d4b187299d159747
SHA1 cbb621c5a8d2cf07901105835d4cab34a5cdef3f
SHA512 34c2ae855dab03467e309ed6f4623ee53ba8e8468b45b85240ec2f3c3f4a80e258f6fcb7addcb44d92ee80dbce42f8b1c92f18e4e4342897eb321982fa588798
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.bhgautopartes.com
Port
587
Username
[email protected]
Password
icui4cu2@@

Targets

- Target
  PO #30114.exe
- Size 121KB
- SHA256 64613e9558bf51f7c56f7e3f7a7d770e87859e8a8bac31a67c6dab53c59d53d5
- MD5 294b7c06479a50f7d4b187299d159747
- SHA1 cbb621c5a8d2cf07901105835d4cab34a5cdef3f
- SHA512 34c2ae855dab03467e309ed6f4623ee53ba8e8468b45b85240ec2f3c3f4a80e258f6fcb7addcb44d92ee80dbce42f8b1c92f18e4e4342897eb321982fa588798
- MD5 SHA1 SHA512
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslakeyloggerspywarestealertrojan