agenttesla | f7d23a1a9687e11409154eef5ff6e38b0ce19bd6747b45814cd6221ee1bc02cd | Triage

Submit
Reports

Overview

overview

Static

static

SecuriteIn...41.rtf

windows7-x64

SecuriteIn...41.rtf

windows10-2004-x64

1

Sharing

General

Target

SecuriteInfo.com.Exploit.CVE-2017-11882.123.19899.13341.rtf
Size

8KB
Sample

221206-jgyqwsag8t
MD5

b21080496cd06c4ec05a717005ac8de0
SHA1

19e19d2cfb4beb2b01a58e946686b65670fa1d5b
SHA256

f7d23a1a9687e11409154eef5ff6e38b0ce19bd6747b45814cd6221ee1bc02cd
SHA512

2a14ea6b993798af7ef501dd2f482f3857baa0a3c2d006ac76f693d8cee5fd1751979e4599cbda29f02c7d0e637b29752f8fb2d96a8573c452bacce8f4cb4756
SSDEEP

192:yjuVkiWDShim94VQiCO3Ya+KizjfVQ6jNM99HTbBGG:yjuVkciizipIn9zjdBM9pBGG

Score

10^/10

agenttesla keylogger spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

SecuriteInfo.com.Exploit.CVE-2017-11882.123.19899.13341.rtf

Resource

win7-20221111-en

agenttesla keylogger spyware stealer trojan

windows7-x64

17 signatures

150 seconds

Behavioral task

behavioral2

Sample

SecuriteInfo.com.Exploit.CVE-2017-11882.123.19899.13341.rtf

Resource

win10v2004-20221111-en

windows10-2004-x64

0 signatures

150 seconds

Malware Config

Extracted

Family

agenttesla

C2

https://discord.com/api/webhooks/1048308947817353288/5ypgS4XmSt1xW_MYhzjePp8jxnOIkdnEO0OTccrP0m7sB3ynEyezAUtrX-js6a4kTsJ8

Targets

- Target
  
  SecuriteInfo.com.Exploit.CVE-2017-11882.123.19899.13341.rtf
- Size
  
  8KB
- MD5
  
  b21080496cd06c4ec05a717005ac8de0
- SHA1
  
  19e19d2cfb4beb2b01a58e946686b65670fa1d5b
- SHA256
  
  f7d23a1a9687e11409154eef5ff6e38b0ce19bd6747b45814cd6221ee1bc02cd
- SHA512
  
  2a14ea6b993798af7ef501dd2f482f3857baa0a3c2d006ac76f693d8cee5fd1751979e4599cbda29f02c7d0e637b29752f8fb2d96a8573c452bacce8f4cb4756
- SSDEEP
  
  192:yjuVkiWDShim94VQiCO3Ya+KizjfVQ6jNM99HTbBGG:yjuVkciizipIn9zjdBM9pBGG
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Exploitation for Client Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

© 2018-2024

Terms | Privacy