agenttesla

General

Target
4ce42f872a55b78f937b36fc38968788eb0db778a8a9e4cd2bef5db79c2b4f2a.exe
Size 594KB
Sample260205-sd558sgx5e
SHA256 4ce42f872a55b78f937b36fc38968788eb0db778a8a9e4cd2bef5db79c2b4f2a
MD5 1bbc410d44644d9e5a73882195531494
SHA1 9bdc63bab838255f210ec6f4a90802d2ae90a4e5
SHA512 b4b58604ca86ad594e549c4f64859a20e3b74771251bb2ffee3d508ccd93dbb51cfbc8bfcc9a1fed488321447910444ea7f7432c7a7bb19eba12875281032b4f
SSDEEP 12288:bz7hU5I5yuNHIgzSFKxWltRohBfSTso93U5wj5/p/GMXv2NNxQevB:bf+iN57Gtene3gQ/pj+NNievB
TLSH
T10FD4229665C1A820C1546330C436CDA889383DB0AD12B76EC76DE5AFBCB13D3EA3665D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.cottondreams.org
Port
587
Username
[email protected]
Password
Payday2025
Email to
[email protected]

Targets

- Target
  4ce42f872a55b78f937b36fc38968788eb0db778a8a9e4cd2bef5db79c2b4f2a.exe
- Size 594KB
- SHA256 4ce42f872a55b78f937b36fc38968788eb0db778a8a9e4cd2bef5db79c2b4f2a
- MD5 1bbc410d44644d9e5a73882195531494
- SHA1 9bdc63bab838255f210ec6f4a90802d2ae90a4e5
- SHA512 b4b58604ca86ad594e549c4f64859a20e3b74771251bb2ffee3d508ccd93dbb51cfbc8bfcc9a1fed488321447910444ea7f7432c7a7bb19eba12875281032b4f
- SSDEEP 12288:bz7hU5I5yuNHIgzSFKxWltRohBfSTso93U5wj5/p/GMXv2NNxQevB:bf+iN57Gtene3gQ/pj+NNievB
- TLSH
  T10FD4229665C1A820C1546330C436CDA889383DB0AD12B76EC76DE5AFBCB13D3EA3665D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery agenttesla keylogger spyware stealer trojan upx
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Agenttesla family

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2