agenttesla | daf7d6d79f4d9d5024e5e2af715196bf6c5a0d8a78a37ef55cda9c755aafc93b | Triage

Submit
Reports

Overview

overview

Static

static

daf7d6d79f...3b.exe

windows7-x64

daf7d6d79f...3b.exe

windows10-2004-x64

Sharing

General

Target

daf7d6d79f4d9d5024e5e2af715196bf6c5a0d8a78a37ef55cda9c755aafc93b
Size

728KB
Sample

221130-wkylhsfb7z
MD5

a4d6028a97ae92bdcb8ecd3b80274470
SHA1

90f79f8b451d34ca9367dcda0401cc813773d32e
SHA256

daf7d6d79f4d9d5024e5e2af715196bf6c5a0d8a78a37ef55cda9c755aafc93b
SHA512

968d3e5aa8a38c0126a7d68146224943472e08934f4fa543f16bf3868e7e56acf51ef2e7824d30a0c97843a44a84eca02fe6f31f56eef1f40e252f9e201d00d2
SSDEEP

12288:nsdrz5gDu9mda+hqzX7XEnTE0v+JP78aTRySWquJBEku2FAcYv2tasGHW:sd62m4zrITEiaH7cBFreutasoW

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

daf7d6d79f4d9d5024e5e2af715196bf6c5a0d8a78a37ef55cda9c755aafc93b.exe

Resource

win7-20221111-en

agenttesla keylogger persistence spyware stealer trojan

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral2

Sample

daf7d6d79f4d9d5024e5e2af715196bf6c5a0d8a78a37ef55cda9c755aafc93b.exe

Resource

win10v2004-20221111-en

agenttesla keylogger persistence spyware stealer trojan

windows10-2004-x64

7 signatures

150 seconds

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yatchbabara.com
Port:
587
Username:
[email protected]
Password:
j$Mk$NE7

Targets

- Target
  
  daf7d6d79f4d9d5024e5e2af715196bf6c5a0d8a78a37ef55cda9c755aafc93b
- Size
  
  728KB
- MD5
  
  a4d6028a97ae92bdcb8ecd3b80274470
- SHA1
  
  90f79f8b451d34ca9367dcda0401cc813773d32e
- SHA256
  
  daf7d6d79f4d9d5024e5e2af715196bf6c5a0d8a78a37ef55cda9c755aafc93b
- SHA512
  
  968d3e5aa8a38c0126a7d68146224943472e08934f4fa543f16bf3868e7e56acf51ef2e7824d30a0c97843a44a84eca02fe6f31f56eef1f40e252f9e201d00d2
- SSDEEP
  
  12288:nsdrz5gDu9mda+hqzX7XEnTE0v+JP78aTRySWquJBEku2FAcYv2tasGHW:sd62m4zrITEiaH7cBFreutasoW
Score

10^/10

agenttesla keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslakeyloggerpersistencespywarestealertrojan

behavioral2

agentteslakeyloggerpersistencespywarestealertrojan

© 2018-2024

Terms | Privacy