agenttesla | e7864a121c2abe3f5398b03986d53cef01044dc8ba32e0cd30448d3ae8a78112 | Triage

Analysis

max time kernel
0s
max time network
6s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08-12-2023 11:37

Sharing

Report Analysis Logs

General

Target

e7864a121c2abe3f5398b03986d53cef01044dc8ba32e0cd30448d3ae8a78112.exe
Size

428KB
MD5

4c9af850d4330bf16c8f83c29ca3d815
SHA1

ac4351d1632fab668c03c391e1f67e0c64fe117d
SHA256

e7864a121c2abe3f5398b03986d53cef01044dc8ba32e0cd30448d3ae8a78112
SHA512

ff41ebcb04890d2a3b09118dd03d5b6fa17c4f7c6ddbc2832a470ea3435cf38fae873efecb6cff261469e09e2aeb97982bfa11d62bdb898dc0b5c3ad354beed1
SSDEEP

6144:Wv67updRtZ8YGvN7bnCRn6/H7+bU+A61stvLGyELbMUTKZ:EpdRtZzGvN7f7+B1SiyyjK

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.code-jet.com
Port:
21
Username:
[email protected]
Password:
4+i)Wf,h^zRm

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.code-jet.com
Port:
21
Username:
[email protected]
Password:
4+i)Wf,h^zRm

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

C:\Users\Admin\AppData\Local\Temp\e7864a121c2abe3f5398b03986d53cef01044dc8ba32e0cd30448d3ae8a78112.exe
"C:\Users\Admin\AppData\Local\Temp\e7864a121c2abe3f5398b03986d53cef01044dc8ba32e0cd30448d3ae8a78112.exe"
1⤵
PID:1764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1764-0-0x00000000000D0000-0x0000000000140000-memory.dmp

Filesize
448KB

Download
memory/1764-1-0x0000000074470000-0x0000000074B5E000-memory.dmp

Filesize
6.9MB

Download
memory/1764-2-0x0000000004920000-0x0000000004960000-memory.dmp

Filesize
256KB

Download