AgentTesla Malware Analizi
Dosya Ozellikleri
SHA256: 3a538ef02cc87ab0fd12ffb13cb1c86f31e7d0ec36760296628756b4edb4211e
MD5: d8abe95d007beaaa1859cbe31f78185c
Dosya Tipi: exe
Boyut: 1,116,672 byte
Ilk Gorulme: 2026-05-21
AV Imzasi: AgentTesla
Imphash: 649f6ed9a4d576c154bbc0357156a4a4
Raporlayan: TomU
Etiketler: AgentTesla, exe
Statik analiz: metadata tabanli (ornek indirilmedi)
AgentTesla — Profil du malware
AgentTesla .NET credential stealer. JS dropper @version 8.16.22. Sayısal obfuscation v6034. SMTP FTP HTTP C2.
Détails techniques
C#/.NET, SMTP/FTP/HTTP C2, GetAsyncKeyState keylogger, browser stealer (Chrome/Firefox/Edge), email client stealer, FTP stealer, VPN stealer, clipboard monitor, screenshot
Attribution / Acteur de la menace
Turkce konusulan gelistirici 'Turk Hack Team' ile iliskilendirilen ve Turkiye'den yonetildigi dusunulen platform. Pek cok farkli siber suc grubu musterisi bulunmaktadir.
Capacités et comportement
Liste IOC (1 indicateurs)
# FILEPATH
3a538ef02cc87ab0fd12ffb13cb1c86f31e7d0ec36760296628756b4edb4211e
| Type | Valeur | Note |
|---|---|---|
| filepath | 3a538ef02cc87ab0fd12ffb13cb1c86f31e7d0ec36760296628756b4edb4211e | PDB |
Serveurs C2 (8 serveurs enregistrés pour cette famille)
| Adresse | Type | Port | Protocole | Statut | Pays |
|---|---|---|---|---|---|
| digicert.com | domain | — | TCP | active | — |
| stem.ru | domain | — | TCP | active | — |
| digicert.com | domain | — | TCP | active | — |
| system.io | domain | — | TCP | active | — |
| dublincore.org | domain | — | TCP | active | — |
| system.io | domain | — | TCP | active | — |
| system.io | domain | — | TCP | active | — |
| googleapis.com | domain | — | TCP | active | — |
Les adresses C2 proviennent uniquement d'échantillons de malwares vérifiés manuellement par l'équipe KEYDAL. Toute utilisation commerciale est interdite.