agenttesla | fad6952d13fe03d8e9a8f04e8168be03ce0b8deb45de91123fa82ff890aafc5f | Triage

Submit
Reports

Overview

overview

Static

static

INV_swift_...DF.exe

windows7-x64

INV_swift_...DF.exe

windows10-2004-x64

Sharing

General

Target

INV_swift_copy_HSB03102022000000000000000PDF.exe
Size

359KB
Sample

221003-m989wadcc8
MD5

6e5d443a7f5dccc55b847619195cce38
SHA1

1f1b6d4b599ffdd2e79988311f509c0008f84d8f
SHA256

fad6952d13fe03d8e9a8f04e8168be03ce0b8deb45de91123fa82ff890aafc5f
SHA512

cbad6371167d51aef3f692ddb0a41000e04cd737aa64a7f95bfc676115df4fe8291a52f0e79f9d3449887571c017260e42eaf8e95e70b23be78a8089a2f9b7de
SSDEEP

3072:xMDX5HiIs1qlP0ZSbJqU4wWp5JGfou49wWCZ/13NFJPqV+9wqY+mhhhmitqOCnq:x6JHPs1qlPyqqU49dFvCZ/13NoKi

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

INV_swift_copy_HSB03102022000000000000000PDF.exe

Resource

win7-20220901-en

agenttesla keylogger spyware stealer trojan

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

INV_swift_copy_HSB03102022000000000000000PDF.exe

Resource

win10v2004-20220812-en

agenttesla collection keylogger spyware stealer trojan

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.botswlogistics.com
Port:
587
Username:
limitless@botswlogistics.com
Password:
*(QSTCj8

Targets

- Target
  
  INV_swift_copy_HSB03102022000000000000000PDF.exe
- Size
  
  359KB
- MD5
  
  6e5d443a7f5dccc55b847619195cce38
- SHA1
  
  1f1b6d4b599ffdd2e79988311f509c0008f84d8f
- SHA256
  
  fad6952d13fe03d8e9a8f04e8168be03ce0b8deb45de91123fa82ff890aafc5f
- SHA512
  
  cbad6371167d51aef3f692ddb0a41000e04cd737aa64a7f95bfc676115df4fe8291a52f0e79f9d3449887571c017260e42eaf8e95e70b23be78a8089a2f9b7de
- SSDEEP
  
  3072:xMDX5HiIs1qlP0ZSbJqU4wWp5JGfou49wWCZ/13NFJPqV+9wqY+mhhhmitqOCnq:x6JHPs1qlPyqqU49dFvCZ/13NoKi
Score

10^/10

agenttesla keylogger spyware stealer trojan collection
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslacollectionkeyloggerspywarestealertrojan

© 2018-2024

Terms | Privacy