agenttesla | 3edbfa536e3f17dd5197bad95088e58fc5762a45dcf6152802dcd3cb289d6976 | Triage

Submit
Reports

Overview

overview

Static

static

scan11062020.exe

windows7_x64

scan11062020.exe

windows10-2004_x64

Sharing

General

Target

3edbfa536e3f17dd5197bad95088e58fc5762a45dcf6152802dcd3cb289d6976
Size

414KB
Sample

220521-bwbwnscef7
MD5

6c9d5f8c9963149c1fa5d48696b27c20
SHA1

64476e635c84ebbd9cc21da565996854e4f26d85
SHA256

3edbfa536e3f17dd5197bad95088e58fc5762a45dcf6152802dcd3cb289d6976
SHA512

0ab4d82f9fa58575412f85b0978fff3e85c69c26dee0dcf280cd58d2cb2290ee81c38bf17e9f1b0e57a61e2630b95d2d4f9f311ee7692d72fe53558282ad2713

Score

10^/10

agenttesla collection evasion keylogger persistence spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

scan11062020.exe

Resource

win7-20220414-en

agenttesla collection evasion keylogger persistence spyware stealer trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

scan11062020.exe

Resource

win10v2004-20220414-en

agenttesla collection evasion keylogger persistence spyware stealer trojan

windows10-2004_x64

0 signatures

0 seconds

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.pptoursperu.com
Port:
587
Username:
[email protected]
Password:
mailppt2019-

Targets

- Target
  
  scan11062020.exe
- Size
  
  501KB
- MD5
  
  9e0f05b03c09d15ca55851c8644a5684
- SHA1
  
  406c628e80a0d2ded0a91285d167a33ec4aee862
- SHA256
  
  d2fc8ce856e5259480e5dd3e9d2f76a24242d5e52f656fa9d0f87bdd57b18f6a
- SHA512
  
  0a461e4e0493f42ff179f8d59f4495ee0d7cd87c00fab526e002a4b5f80459237c0ce0bf622884c47badd00ed6ed024f3e6c945bd2f992c26bf61e1a62421545
Score

10^/10

agenttesla collection evasion keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Disables Task Manager via registry modification
  evasion
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

agentteslacollectionevasionkeyloggerpersistencespywarestealertrojan

behavioral2

agentteslacollectionevasionkeyloggerpersistencespywarestealertrojan

© 2018-2024

Terms | Privacy