AgentTesla Malware Analizi
Dosya Ozellikleri
SHA256: 8b8307812d5a8ec31931468bb24e5a1ded3150cb8507a2fbd799ef5effa7abc8
MD5: 6f05e222fc898de80209d57c2016f428
Dosya Tipi: js
Boyut: 18,684 byte
Ilk Gorulme: 2026-04-28
AV Imzasi: AgentTesla
Raporlayan: BastianHein_
Etiketler: AgentTesla, js
Statik analiz: metadata tabanli (ornek indirilmedi)
AgentTesla — Profil du malware
AgentTesla .NET credential stealer. JS dropper @version 8.16.22. Sayısal obfuscation v6034. SMTP FTP HTTP C2.
Détails techniques
C#/.NET, SMTP/FTP/HTTP C2, GetAsyncKeyState keylogger, browser stealer (Chrome/Firefox/Edge), email client stealer, FTP stealer, VPN stealer, clipboard monitor, screenshot
Attribution / Acteur de la menace
Turkce konusulan gelistirici 'Turk Hack Team' ile iliskilendirilen ve Turkiye'den yonetildigi dusunulen platform. Pek cok farkli siber suc grubu musterisi bulunmaktadir.
Capacités et comportement
Liste IOC (1 indicateurs)
# FILEPATH
8b8307812d5a8ec31931468bb24e5a1ded3150cb8507a2fbd799ef5effa7abc8
| Type | Valeur | Note |
|---|---|---|
| filepath | 8b8307812d5a8ec31931468bb24e5a1ded3150cb8507a2fbd799ef5effa7abc8 | PDB |
Serveurs C2 (8 serveurs enregistrés pour cette famille)
| Adresse | Type | Port | Protocole | Statut | Pays |
|---|---|---|---|---|---|
| digicert.com | domain | — | TCP | active | — |
| stem.ru | domain | — | TCP | active | — |
| digicert.com | domain | — | TCP | active | — |
| system.io | domain | — | TCP | active | — |
| dublincore.org | domain | — | TCP | active | — |
| system.io | domain | — | TCP | active | — |
| system.io | domain | — | TCP | active | — |
| googleapis.com | domain | — | TCP | active | — |
Les adresses C2 proviennent uniquement d'échantillons de malwares vérifiés manuellement par l'équipe KEYDAL. Toute utilisation commerciale est interdite.