agenttesla | beaea50cc1463657fa14f11a74d13abe27f17d1ffa404c3f078d6975e08b57f7 | Triage

Submit
Reports

Overview

overview

Static

static

5

beaea50cc1...f7.exe

windows7-x64

beaea50cc1...f7.exe

windows10-2004-x64

Sharing

General

Target

beaea50cc1463657fa14f11a74d13abe27f17d1ffa404c3f078d6975e08b57f7
Size

1.0MB
Sample

240428-bpdfxscg86
MD5

9a944f421bbbec0e5d484eb9ac2070b2
SHA1

5077ffcbfbf9bbc102a4e3a9876bec2cb40412c3
SHA256

beaea50cc1463657fa14f11a74d13abe27f17d1ffa404c3f078d6975e08b57f7
SHA512

e4cf75422afef0bd64bfa53dfeb1ef90741c94d0175748bd62b1e82ef80c53f66a7bbd00b1cf763f7e98ed3510dacaa64db03ff0f62d6cdd876ab686552c09c9
SSDEEP

24576:fAHnh+eWsN3skA4RV1Hom2KXMmHa3dt79iu5:Ch+ZkldoPK8Ya3lL

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

beaea50cc1463657fa14f11a74d13abe27f17d1ffa404c3f078d6975e08b57f7.exe

Resource

win7-20240221-en

agenttesla collection keylogger spyware stealer trojan

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

beaea50cc1463657fa14f11a74d13abe27f17d1ffa404c3f078d6975e08b57f7.exe

Resource

win10v2004-20240426-en

agenttesla collection keylogger spyware stealer trojan

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.corpsa.net
Port:
21
Username:
vodooooo@corpsa.net
Password:
-E~O8rekW5UT

Targets

- Target
  
  beaea50cc1463657fa14f11a74d13abe27f17d1ffa404c3f078d6975e08b57f7
- Size
  
  1.0MB
- MD5
  
  9a944f421bbbec0e5d484eb9ac2070b2
- SHA1
  
  5077ffcbfbf9bbc102a4e3a9876bec2cb40412c3
- SHA256
  
  beaea50cc1463657fa14f11a74d13abe27f17d1ffa404c3f078d6975e08b57f7
- SHA512
  
  e4cf75422afef0bd64bfa53dfeb1ef90741c94d0175748bd62b1e82ef80c53f66a7bbd00b1cf763f7e98ed3510dacaa64db03ff0f62d6cdd876ab686552c09c9
- SSDEEP
  
  24576:fAHnh+eWsN3skA4RV1Hom2KXMmHa3dt79iu5:Ch+ZkldoPK8Ya3lL
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

agentteslacollectionkeyloggerspywarestealertrojan

behavioral2

agentteslacollectionkeyloggerspywarestealertrojan

© 2018-2024

Terms | Privacy