agenttesla | 832d243861035e21f268e5dd0ef03dc289a9448aca36cdae4449bbc7cb30d0da | Triage

Submit
Reports

Overview

overview

Static

static

832d243861...da.exe

windows7-x64

832d243861...da.exe

windows10-2004-x64

Sharing

General

Target

832d243861035e21f268e5dd0ef03dc289a9448aca36cdae4449bbc7cb30d0da.exe
Size

669KB
Sample

221206-prrcfshc68
MD5

9ae305b0f8e1766b18dfeeb71a4448fe
SHA1

6c90cfad19dec005363307cf428c1e71cc95aec7
SHA256

832d243861035e21f268e5dd0ef03dc289a9448aca36cdae4449bbc7cb30d0da
SHA512

4753c3bac1ba3cbef479894fcb21e65170aa68f3c4b2291421ad12b06c078088bbb958a4db48dadb851bbe1f296c0b185a74775289b1c0b39cfc03c00f789bda
SSDEEP

12288:S5cMpbKbfSdZ8j6c0auzbQrRBc54wqArINxw3Qi+:SqKbKCZ8jUaAMRBc54zAErw3Q

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

832d243861035e21f268e5dd0ef03dc289a9448aca36cdae4449bbc7cb30d0da.exe

Resource

win7-20220812-en

agenttesla keylogger persistence spyware stealer trojan

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral2

Sample

832d243861035e21f268e5dd0ef03dc289a9448aca36cdae4449bbc7cb30d0da.exe

Resource

win10v2004-20221111-en

windows10-2004-x64

0 signatures

150 seconds

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot1360033246:AAF6H8m6YrL09doyxtsvJzZ_cIl__BCF4aU/sendDocument

Targets

- Target
  
  832d243861035e21f268e5dd0ef03dc289a9448aca36cdae4449bbc7cb30d0da.exe
- Size
  
  669KB
- MD5
  
  9ae305b0f8e1766b18dfeeb71a4448fe
- SHA1
  
  6c90cfad19dec005363307cf428c1e71cc95aec7
- SHA256
  
  832d243861035e21f268e5dd0ef03dc289a9448aca36cdae4449bbc7cb30d0da
- SHA512
  
  4753c3bac1ba3cbef479894fcb21e65170aa68f3c4b2291421ad12b06c078088bbb958a4db48dadb851bbe1f296c0b185a74775289b1c0b39cfc03c00f789bda
- SSDEEP
  
  12288:S5cMpbKbfSdZ8j6c0auzbQrRBc54wqArINxw3Qi+:SqKbKCZ8jUaAMRBc54zAErw3Q
Score

10^/10

agenttesla keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslakeyloggerpersistencespywarestealertrojan

behavioral2

© 2018-2024

Terms | Privacy