agenttesla | 479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24 | Triage

Submit
Reports

Overview

overview

Static

static

479f557c55...24.exe

windows7_x64

479f557c55...24.exe

windows10-2004_x64

Sharing

General

Target

479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24
Size

718KB
Sample

220414-pxfsxaghfr
MD5

4723100da4878c6e30761960809f1d5d
SHA1

09440545558fde0df0ce5a604921d1666b8dadfe
SHA256

479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24
SHA512

86fab8dcf491e352eb2beeb0c1f8046f72625a459578e6c421dab0b1f3599547833b73572b1bf5661c3d12eecb1e7c8c8cc8465b5e805d25f744045cce1aed03

Score

10^/10

agenttesla metastealer keylogger persistence spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24.exe

Resource

win7-20220331-en

agenttesla keylogger spyware stealer trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24.exe

Resource

win10v2004-20220331-en

agenttesla metastealer keylogger persistence spyware stealer trojan

windows10-2004_x64

0 signatures

0 seconds

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.sonoscepa.net
Port:
587
Username:
[email protected]
Password:
VOxcBxxb6

Targets

- Target
  
  479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24
- Size
  
  718KB
- MD5
  
  4723100da4878c6e30761960809f1d5d
- SHA1
  
  09440545558fde0df0ce5a604921d1666b8dadfe
- SHA256
  
  479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24
- SHA512
  
  86fab8dcf491e352eb2beeb0c1f8046f72625a459578e6c421dab0b1f3599547833b73572b1bf5661c3d12eecb1e7c8c8cc8465b5e805d25f744045cce1aed03
Score

10^/10

agenttesla keylogger spyware stealer trojan metastealer persistence
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Meta Stealer Stealer
  Meta Stealer steals passwords stored in browsers, written in C++.
  stealer metastealer
- AgentTesla Payload
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslametastealerkeyloggerpersistencespywarestealertrojan

© 2018-2025

Terms | Privacy