AgentTesla Malware Analizi
Dosya Ozellikleri
SHA256: 7bc6aab89fe15db84fa5b44db79349c7c1295404a7c4ff60d3e900b566486bd2
MD5: 56ca86a58fe7900ad5df5ed8c219518f
Dosya Tipi: exe
Boyut: 655,360 byte
Ilk Gorulme: 2026-05-20
AV Imzasi: AgentTesla
Imphash: 2190d96a3b1dfc387e493d7b9ed15eec
Raporlayan: James_inthe_box
Etiketler: AgentTesla, exe
Statik analiz: metadata tabanli (ornek indirilmedi)
AgentTesla — Profil du malware
AgentTesla .NET credential stealer. JS dropper @version 8.16.22. Sayısal obfuscation v6034. SMTP FTP HTTP C2.
Détails techniques
C#/.NET, SMTP/FTP/HTTP C2, GetAsyncKeyState keylogger, browser stealer (Chrome/Firefox/Edge), email client stealer, FTP stealer, VPN stealer, clipboard monitor, screenshot
Attribution / Acteur de la menace
Turkce konusulan gelistirici 'Turk Hack Team' ile iliskilendirilen ve Turkiye'den yonetildigi dusunulen platform. Pek cok farkli siber suc grubu musterisi bulunmaktadir.
Capacités et comportement
Liste IOC (1 indicateurs)
# FILEPATH
7bc6aab89fe15db84fa5b44db79349c7c1295404a7c4ff60d3e900b566486bd2
| Type | Valeur | Note |
|---|---|---|
| filepath | 7bc6aab89fe15db84fa5b44db79349c7c1295404a7c4ff60d3e900b566486bd2 | PDB |
Serveurs C2 (8 serveurs enregistrés pour cette famille)
| Adresse | Type | Port | Protocole | Statut | Pays |
|---|---|---|---|---|---|
| digicert.com | domain | — | TCP | active | — |
| stem.ru | domain | — | TCP | active | — |
| digicert.com | domain | — | TCP | active | — |
| system.io | domain | — | TCP | active | — |
| dublincore.org | domain | — | TCP | active | — |
| system.io | domain | — | TCP | active | — |
| system.io | domain | — | TCP | active | — |
| googleapis.com | domain | — | TCP | active | — |
Les adresses C2 proviennent uniquement d'échantillons de malwares vérifiés manuellement par l'équipe KEYDAL. Toute utilisation commerciale est interdite.