agenttesla | f412632bebcaca6378f86d146dc85d9eebf36f0804c82f2e6e31da31e0e0830c | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

dridex

windows10-2004-x64

Sharing

General

Target

f412632bebcaca6378f86d146dc85d9eebf36f0804c82f2e6e31da31e0e0830c
Size

958KB
Sample

220914-csct8shah6
MD5

42185bcb27895d422b5ff10b43768bfa
SHA1

5b18d88c908aee0b37d4cac68060a4871a3c8069
SHA256

f412632bebcaca6378f86d146dc85d9eebf36f0804c82f2e6e31da31e0e0830c
SHA512

7719bb25575506ab42221252dd5a4ee0e0155e2e2ecf21294b55a2e214f52f868daf7c00e1e63800a88fe3b3025b8da9ff4bb125b8db0ae5a73a22dc63f67738
SSDEEP

12288:sPdV7uikFg7hSV20JP/kEtRec6qrW3bpkxtAjiiuDGVF8J8/3fS:KlubgdSb/nt76q3tGiwFGG3f

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

f412632bebcaca6378f86d146dc85d9eebf36f0804c82f2e6e31da31e0e0830c.exe

Resource

win10v2004-20220901-en

agenttesla collection keylogger spyware stealer trojan

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
viorel5000@yandex.ru
Password:
YAWALESS123@@

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
%2B
Port:
21
Username:
application/x-www-form-urlencoded
Password:
image/jpg

C2

p=

Targets

- Target
  
  f412632bebcaca6378f86d146dc85d9eebf36f0804c82f2e6e31da31e0e0830c
- Size
  
  958KB
- MD5
  
  42185bcb27895d422b5ff10b43768bfa
- SHA1
  
  5b18d88c908aee0b37d4cac68060a4871a3c8069
- SHA256
  
  f412632bebcaca6378f86d146dc85d9eebf36f0804c82f2e6e31da31e0e0830c
- SHA512
  
  7719bb25575506ab42221252dd5a4ee0e0155e2e2ecf21294b55a2e214f52f868daf7c00e1e63800a88fe3b3025b8da9ff4bb125b8db0ae5a73a22dc63f67738
- SSDEEP
  
  12288:sPdV7uikFg7hSV20JP/kEtRec6qrW3bpkxtAjiiuDGVF8J8/3fS:KlubgdSb/nt76q3tGiwFGG3f
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslacollectionkeyloggerspywarestealertrojan

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.