AgentTesla Malware Analizi
Dosya Ozellikleri
SHA256: 9079dcbdc9ef5c34052eb9e8c1d2f80be47c3f1dffa4414f83e9b911ca30a6c8
MD5: 7a71edb304bd05c9340cbd303cd82291
Dosya Tipi: bat
Boyut: 7,998 byte
Ilk Gorulme: 2026-04-23
AV Imzasi: AgentTesla
Raporlayan: lowmal3
Etiketler: AgentTesla, bat
Statik analiz: metadata tabanli (ornek indirilmedi)
AgentTesla — Profil du malware
AgentTesla .NET credential stealer. JS dropper @version 8.16.22. Sayısal obfuscation v6034. SMTP FTP HTTP C2.
Détails techniques
C#/.NET, SMTP/FTP/HTTP C2, GetAsyncKeyState keylogger, browser stealer (Chrome/Firefox/Edge), email client stealer, FTP stealer, VPN stealer, clipboard monitor, screenshot
Attribution / Acteur de la menace
Turkce konusulan gelistirici 'Turk Hack Team' ile iliskilendirilen ve Turkiye'den yonetildigi dusunulen platform. Pek cok farkli siber suc grubu musterisi bulunmaktadir.
Capacités et comportement
Liste IOC (1 indicateurs)
# FILEPATH
9079dcbdc9ef5c34052eb9e8c1d2f80be47c3f1dffa4414f83e9b911ca30a6c8
| Type | Valeur | Note |
|---|---|---|
| filepath | 9079dcbdc9ef5c34052eb9e8c1d2f80be47c3f1dffa4414f83e9b911ca30a6c8 | PDB |
Serveurs C2 (8 serveurs enregistrés pour cette famille)
| Adresse | Type | Port | Protocole | Statut | Pays |
|---|---|---|---|---|---|
| digicert.com | domain | — | TCP | active | — |
| stem.ru | domain | — | TCP | active | — |
| digicert.com | domain | — | TCP | active | — |
| system.io | domain | — | TCP | active | — |
| dublincore.org | domain | — | TCP | active | — |
| system.io | domain | — | TCP | active | — |
| system.io | domain | — | TCP | active | — |
| googleapis.com | domain | — | TCP | active | — |
Les adresses C2 proviennent uniquement d'échantillons de malwares vérifiés manuellement par l'équipe KEYDAL. Toute utilisation commerciale est interdite.