agenttesla | ab824dd589ac6ab9174d19ee59f190f980893032af0367fce98c0bb1341eea12 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

3ab405f881...27.exe

windows7-x64

3ab405f881...27.exe

windows10-2004-x64

Sharing

General

Target

3ab405f881bcaf58d12a7ff1664b5527
Size

1.1MB
Sample

231225-y1r5sagdfn
MD5

3ab405f881bcaf58d12a7ff1664b5527
SHA1

0ef30549ac70ce85b5e837095b66ef439964ab47
SHA256

ab824dd589ac6ab9174d19ee59f190f980893032af0367fce98c0bb1341eea12
SHA512

037316d0e83436eab68d83b4514762bd71ad70c25696008e557beef2b15bed92c84e1dfaf9a660c9b2d91e936ecccaf88fb3efc28fef3356c4d0c078f7b4e755
SSDEEP

24576:/h7EGFXW5oaXpcB7mVSaccPuvcd5OGQT/1/0nS+7n4SYwqK4zf3RTsAHWAgqChJM:pIGmiecP/Otdh

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

3ab405f881bcaf58d12a7ff1664b5527.exe

Resource

win7-20231215-en

agenttesla keylogger persistence spyware stealer trojan

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral2

Sample

3ab405f881bcaf58d12a7ff1664b5527.exe

Resource

win10v2004-20231215-en

agenttesla keylogger spyware stealer trojan

windows10-2004-x64

6 signatures

150 seconds

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.avonpharmacmachines.com/
Port:
21
Username:
[email protected]
Password:
ycULZlOO,T9=

Targets

- Target
  
  3ab405f881bcaf58d12a7ff1664b5527
- Size
  
  1.1MB
- MD5
  
  3ab405f881bcaf58d12a7ff1664b5527
- SHA1
  
  0ef30549ac70ce85b5e837095b66ef439964ab47
- SHA256
  
  ab824dd589ac6ab9174d19ee59f190f980893032af0367fce98c0bb1341eea12
- SHA512
  
  037316d0e83436eab68d83b4514762bd71ad70c25696008e557beef2b15bed92c84e1dfaf9a660c9b2d91e936ecccaf88fb3efc28fef3356c4d0c078f7b4e755
- SSDEEP
  
  24576:/h7EGFXW5oaXpcB7mVSaccPuvcd5OGQT/1/0nS+7n4SYwqK4zf3RTsAHWAgqChJM:pIGmiecP/Otdh
Score

10^/10

agenttesla keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslakeyloggerpersistencespywarestealertrojan

behavioral2

agentteslakeyloggerspywarestealertrojan

© 2018-2025

Terms | Privacy