agenttesla | 81162d06ef961d95dc677f8f4f9ced55da496844cf5b769191db72cce15a5263 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

Shipping D...DF.exe

windows7-x64

Shipping D...DF.exe

windows10-2004-x64

Sharing

General

Target

Shipping Document_PDF.exe
Size

425KB
Sample

221219-mcq22aeg72
MD5

316bc2c2ccf689cbda2c83a33a412b32
SHA1

fc31789f4eb66333997c3edbaf585e48d2c3e390
SHA256

81162d06ef961d95dc677f8f4f9ced55da496844cf5b769191db72cce15a5263
SHA512

e0f755d48f986e46cf143b913b37d373fcfc66d4b834ef0aba1d8a8b5ed76e218ec2b90e2eed05c4ff796c59b0afa3baafd3f35e51c33292b4d144019b54bde8
SSDEEP

6144:N8dj5zpTDFLZFBapa52ju7QAdtkgpmNZEs7a+hI:NmFZDFLZFBN+u79dtkgpmEw5I

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

Shipping Document_PDF.exe

Resource

win7-20221111-en

agenttesla collection keylogger spyware stealer trojan

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

Shipping Document_PDF.exe

Resource

win10v2004-20221111-en

agenttesla collection keylogger spyware stealer trojan

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot2062652208:AAEyc-7xEcUOQxNpdlexOidqQZT1Fi23E0A/sendDocument

Targets

- Target
  
  Shipping Document_PDF.exe
- Size
  
  425KB
- MD5
  
  316bc2c2ccf689cbda2c83a33a412b32
- SHA1
  
  fc31789f4eb66333997c3edbaf585e48d2c3e390
- SHA256
  
  81162d06ef961d95dc677f8f4f9ced55da496844cf5b769191db72cce15a5263
- SHA512
  
  e0f755d48f986e46cf143b913b37d373fcfc66d4b834ef0aba1d8a8b5ed76e218ec2b90e2eed05c4ff796c59b0afa3baafd3f35e51c33292b4d144019b54bde8
- SSDEEP
  
  6144:N8dj5zpTDFLZFBapa52ju7QAdtkgpmNZEs7a+hI:NmFZDFLZFBN+u79dtkgpmEw5I
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslacollectionkeyloggerspywarestealertrojan

behavioral2

agentteslacollectionkeyloggerspywarestealertrojan

© 2018-2025

Terms | Privacy