agenttesla | f46e300e4db069550efc75aa67fb2929de58b2c4b543a7f9341b78f951ab9bd8 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

1

BH0ePQy3XJSkIWO.exe

windows7-x64

BH0ePQy3XJSkIWO.exe

windows10-2004-x64

Sharing

General

Target

BH0ePQy3XJSkIWO.exe
Size

676KB
Sample

230419-fnyspagd66
MD5

7c1367abb438f60292f78519fa2b851b
SHA1

75c47cb21be625391991f41d4e55341e68a69410
SHA256

f46e300e4db069550efc75aa67fb2929de58b2c4b543a7f9341b78f951ab9bd8
SHA512

e8e129160f5e97beef5bbfbaf0cdfc0048d4b9d27991989dbb5e633b3a290f18e26957e9ea7a30f1c1b86d2313d233d7586c0480494294a3aad5780ce8d8a12d
SSDEEP

12288:nRBO5ZZC/W2n9xsMHyyE566gQJtJNCXD3jnrleiDs+zjBVs/0zG:nRqTC/fDtS1rJtTCTIig+zjz6

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

BH0ePQy3XJSkIWO.exe

Resource

win7-20230220-en

agenttesla collection keylogger spyware stealer trojan

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

BH0ePQy3XJSkIWO.exe

Resource

win10v2004-20230220-en

agenttesla collection keylogger spyware stealer trojan

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.amwi.net
Port:
587
Username:
ab@doc-henne.de
Password:
7_2se8Gr
Email To:
Uptown-town@post.com

Targets

- Target
  
  BH0ePQy3XJSkIWO.exe
- Size
  
  676KB
- MD5
  
  7c1367abb438f60292f78519fa2b851b
- SHA1
  
  75c47cb21be625391991f41d4e55341e68a69410
- SHA256
  
  f46e300e4db069550efc75aa67fb2929de58b2c4b543a7f9341b78f951ab9bd8
- SHA512
  
  e8e129160f5e97beef5bbfbaf0cdfc0048d4b9d27991989dbb5e633b3a290f18e26957e9ea7a30f1c1b86d2313d233d7586c0480494294a3aad5780ce8d8a12d
- SSDEEP
  
  12288:nRBO5ZZC/W2n9xsMHyyE566gQJtJNCXD3jnrleiDs+zjBVs/0zG:nRqTC/fDtS1rJtTCTIig+zjz6
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslacollectionkeyloggerspywarestealertrojan

behavioral2

agentteslacollectionkeyloggerspywarestealertrojan

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.