agenttesla | 6db3f85bcf24037d49797410a55799c02a83bccbf85d5018bb4f5652d52e967d | Triage

Submit
Reports

Overview

overview

Static

static

3

4854062758...ac.exe

windows7-x64

4854062758...ac.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target

4854062758eee972a3ba7e4accd569ac
Size

887KB
Sample

240107-htsvqsheb2
MD5

4854062758eee972a3ba7e4accd569ac
SHA1

f338daed8c72068475f41c710bda8fe799c3d113
SHA256

6db3f85bcf24037d49797410a55799c02a83bccbf85d5018bb4f5652d52e967d
SHA512

a57badbf333b1e638e6b7bb6665f4f6be0100e37ed63355cfa949a254ae57eccdac0be497ed7060a1cefb05a395bae8f428378f56b9022b15204d52b5da8192b
SSDEEP

12288:MQj/3AQZQoR65AXwgFvuSSwIxCCq4TscppCqdrCdHRllsgEEz/qqcPrHKy0y4L7/:AoR6qgdCq5Cjns0ZcPrqy0yEJgm

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

4854062758eee972a3ba7e4accd569ac.exe

Resource

win7-20231215-en

agenttesla keylogger persistence spyware stealer trojan

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

4854062758eee972a3ba7e4accd569ac.exe

Resource

win10v2004-20231215-en

agenttesla keylogger spyware stealer trojan

windows10-2004-x64

4 signatures

150 seconds

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
[email protected]
Password:
jesus@eze

Targets

- Target
  
  4854062758eee972a3ba7e4accd569ac
- Size
  
  887KB
- MD5
  
  4854062758eee972a3ba7e4accd569ac
- SHA1
  
  f338daed8c72068475f41c710bda8fe799c3d113
- SHA256
  
  6db3f85bcf24037d49797410a55799c02a83bccbf85d5018bb4f5652d52e967d
- SHA512
  
  a57badbf333b1e638e6b7bb6665f4f6be0100e37ed63355cfa949a254ae57eccdac0be497ed7060a1cefb05a395bae8f428378f56b9022b15204d52b5da8192b
- SSDEEP
  
  12288:MQj/3AQZQoR65AXwgFvuSSwIxCCq4TscppCqdrCdHRllsgEEz/qqcPrHKy0y4L7/:AoR6qgdCq5Cjns0ZcPrqy0yEJgm
Score

10^/10

agenttesla keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslakeyloggerpersistencespywarestealertrojan

behavioral2

agentteslakeyloggerspywarestealertrojan

© 2018-2025

Terms | Privacy