agenttesla | 7353a3d45faaf458e6855490cc1972e8fae4b4fb3824e0931a963408754c4ea0 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

4fc3cb83fb...cc.exe

windows7-x64

4fc3cb83fb...cc.exe

windows10-2004-x64

1

Sharing

General

Target

4fc3cb83fb09aa13f11df2ca691538cc
Size

683KB
Sample

240110-gnb5cshea9
MD5

4fc3cb83fb09aa13f11df2ca691538cc
SHA1

05a74ba39d8ab2454fc8c5cd0db8f1ebdd9fc133
SHA256

7353a3d45faaf458e6855490cc1972e8fae4b4fb3824e0931a963408754c4ea0
SHA512

c7deb5fa48f1643079be989f6b6f12662bcbed652de8e02cb05eb8d468e369a3c93297de05357927007a394c94ee3263fc0006008b563ac82391d511f4e9a78c
SSDEEP

12288:zeZhfeOWiVzgnohwXhYySumiRSy2ZaeyTLGI:zs/VzgnohYUiRSy4ALZ

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

4fc3cb83fb09aa13f11df2ca691538cc.exe

Resource

win7-20231215-en

agenttesla keylogger persistence spyware stealer trojan

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

4fc3cb83fb09aa13f11df2ca691538cc.exe

Resource

win10v2004-20231222-en

windows10-2004-x64

0 signatures

150 seconds

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.nonhgyuplogis.com
Port:
587
Username:
[email protected]
Password:
xU$FNUn2

Targets

- Target
  
  4fc3cb83fb09aa13f11df2ca691538cc
- Size
  
  683KB
- MD5
  
  4fc3cb83fb09aa13f11df2ca691538cc
- SHA1
  
  05a74ba39d8ab2454fc8c5cd0db8f1ebdd9fc133
- SHA256
  
  7353a3d45faaf458e6855490cc1972e8fae4b4fb3824e0931a963408754c4ea0
- SHA512
  
  c7deb5fa48f1643079be989f6b6f12662bcbed652de8e02cb05eb8d468e369a3c93297de05357927007a394c94ee3263fc0006008b563ac82391d511f4e9a78c
- SSDEEP
  
  12288:zeZhfeOWiVzgnohwXhYySumiRSy2ZaeyTLGI:zs/VzgnohYUiRSy4ALZ
Score

10^/10

agenttesla keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslakeyloggerpersistencespywarestealertrojan

behavioral2

© 2018-2025

Terms | Privacy