agenttesla | 6f1962f02a28d836a95e44947f589b0288b2af48204a04d9cf1cf3fb347a0c8a | Triage

Submit
Reports

Overview

overview

Static

static

1

6f1962f02a...8a.exe

windows7-x64

6f1962f02a...8a.exe

windows10-2004-x64

Sharing

General

Target

6f1962f02a28d836a95e44947f589b0288b2af48204a04d9cf1cf3fb347a0c8a
Size

248KB
Sample

230207-cgd8xsha48
MD5

901735e1031bd7a7d34d047ea0ff186c
SHA1

1e0f3e506e492faa59b2e50c8f373d4548d58eaf
SHA256

6f1962f02a28d836a95e44947f589b0288b2af48204a04d9cf1cf3fb347a0c8a
SHA512

43f14ae1b7fc54891b86cd40636915a49c7a8b4bdcd00ee07ee1d38ab9547a1a07b30261479ebd818bc8b49b0b7d74d2a95c20195455e5bb462ec701845143f9
SSDEEP

6144:I7BOQlCywM3ykOCuqvHSBmjhilaE7/4Igo:I7qywM3yIVwmtilaEvg

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

6f1962f02a28d836a95e44947f589b0288b2af48204a04d9cf1cf3fb347a0c8a.exe

Resource

win7-20221111-en

agenttesla keylogger spyware stealer trojan

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

6f1962f02a28d836a95e44947f589b0288b2af48204a04d9cf1cf3fb347a0c8a.exe

Resource

win10v2004-20221111-en

agenttesla collection keylogger spyware stealer trojan

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.mgcpakistan.com/
Port:
21
Username:
[email protected]
Password:
boygirl123456

Targets

- Target
  
  6f1962f02a28d836a95e44947f589b0288b2af48204a04d9cf1cf3fb347a0c8a
- Size
  
  248KB
- MD5
  
  901735e1031bd7a7d34d047ea0ff186c
- SHA1
  
  1e0f3e506e492faa59b2e50c8f373d4548d58eaf
- SHA256
  
  6f1962f02a28d836a95e44947f589b0288b2af48204a04d9cf1cf3fb347a0c8a
- SHA512
  
  43f14ae1b7fc54891b86cd40636915a49c7a8b4bdcd00ee07ee1d38ab9547a1a07b30261479ebd818bc8b49b0b7d74d2a95c20195455e5bb462ec701845143f9
- SSDEEP
  
  6144:I7BOQlCywM3ykOCuqvHSBmjhilaE7/4Igo:I7qywM3yIVwmtilaEvg
Score

10^/10

agenttesla keylogger spyware stealer trojan collection
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

agentteslacollectionkeyloggerspywarestealertrojan

© 2018-2024

Terms | Privacy