agenttesla | ae089b8131dc35166d58eaed9895cfae2264f6418c04ca8c7ef48e539d6f0933 | Triage

Submit
Reports

Overview

overview

Static

static

5

ae089b8131...33.exe

windows7-x64

ae089b8131...33.exe

windows10-2004-x64

Sharing

General

Target

ae089b8131dc35166d58eaed9895cfae2264f6418c04ca8c7ef48e539d6f0933
Size

1.4MB
Sample

221204-2ss9nage6t
MD5

8aca8dcdafc7ed863cdafe320fc8823f
SHA1

6945abc4f31d3bda7d44dfc1a054440567221e1e
SHA256

ae089b8131dc35166d58eaed9895cfae2264f6418c04ca8c7ef48e539d6f0933
SHA512

6c4b3aa8c95ee131c353776a134f9cd8c439b85f327d68b80820fb097f7da4a42f323a11d240b219c5b5bda435abc234ea8c3d2f2877c51341c1396c3b373da4
SSDEEP

24576:LAHnh+eWsN3skA4RV1Hom2KXMmHaSv+jU2EgsDjL2MJJVghOaaPmqt2rNWi5:mh+ZkldoPK8YaSvffmgWantUNn

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

ae089b8131dc35166d58eaed9895cfae2264f6418c04ca8c7ef48e539d6f0933.exe

Resource

win7-20221111-en

agenttesla collection keylogger persistence spyware stealer trojan

windows7-x64

16 signatures

150 seconds

Behavioral task

behavioral2

Sample

ae089b8131dc35166d58eaed9895cfae2264f6418c04ca8c7ef48e539d6f0933.exe

Resource

win10v2004-20221111-en

agenttesla collection keylogger persistence spyware stealer trojan

windows10-2004-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  ae089b8131dc35166d58eaed9895cfae2264f6418c04ca8c7ef48e539d6f0933
- Size
  
  1.4MB
- MD5
  
  8aca8dcdafc7ed863cdafe320fc8823f
- SHA1
  
  6945abc4f31d3bda7d44dfc1a054440567221e1e
- SHA256
  
  ae089b8131dc35166d58eaed9895cfae2264f6418c04ca8c7ef48e539d6f0933
- SHA512
  
  6c4b3aa8c95ee131c353776a134f9cd8c439b85f327d68b80820fb097f7da4a42f323a11d240b219c5b5bda435abc234ea8c3d2f2877c51341c1396c3b373da4
- SSDEEP
  
  24576:LAHnh+eWsN3skA4RV1Hom2KXMmHaSv+jU2EgsDjL2MJJVghOaaPmqt2rNWi5:mh+ZkldoPK8YaSvffmgWantUNn
Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Drops startup file
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslacollectionkeyloggerpersistencespywarestealertrojan

behavioral2

agentteslacollectionkeyloggerpersistencespywarestealertrojan

© 2018-2024

Terms | Privacy