agenttesla | af0902b859d5df130dc0b9f8e0541b88da80683721307249b239e5da98050811 | Triage

Submit
Reports

Overview

overview

Static

static

3

07a9c9d3de...18.exe

windows7-x64

07a9c9d3de...18.exe

windows10-2004-x64

Sharing

General

Target

07a9c9d3de53ce20de184c9b22137657_JaffaCakes118
Size

388KB
Sample

240328-rkscaahc44
MD5

07a9c9d3de53ce20de184c9b22137657
SHA1

38db554f03a2b190c7d485c3cb52e6a8d70abba9
SHA256

af0902b859d5df130dc0b9f8e0541b88da80683721307249b239e5da98050811
SHA512

3f98a41b2d9a274c8a855e4b05c99c9ef575df87273961d0cca5660b7631e577606747396cc65e691ed3318cc78371179a8c48bcd8e46ea5fc284ee88bdd8d62
SSDEEP

12288:ABSBmd3IFhfV/AMcIlXbK/sXGgSCkZUKxE:3BRNJZmsXGgroq

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

07a9c9d3de53ce20de184c9b22137657_JaffaCakes118.exe

Resource

win7-20240221-en

agenttesla collection keylogger persistence spyware stealer trojan

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

07a9c9d3de53ce20de184c9b22137657_JaffaCakes118.exe

Resource

win10v2004-20231215-en

agenttesla collection keylogger persistence spyware stealer trojan

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
sg2plcpnl0023.prod.sin2.secureserver.net
Port:
587
Username:
nbsupports@seshsupports.com
Password:
User@40378

Targets

- Target
  
  07a9c9d3de53ce20de184c9b22137657_JaffaCakes118
- Size
  
  388KB
- MD5
  
  07a9c9d3de53ce20de184c9b22137657
- SHA1
  
  38db554f03a2b190c7d485c3cb52e6a8d70abba9
- SHA256
  
  af0902b859d5df130dc0b9f8e0541b88da80683721307249b239e5da98050811
- SHA512
  
  3f98a41b2d9a274c8a855e4b05c99c9ef575df87273961d0cca5660b7631e577606747396cc65e691ed3318cc78371179a8c48bcd8e46ea5fc284ee88bdd8d62
- SSDEEP
  
  12288:ABSBmd3IFhfV/AMcIlXbK/sXGgSCkZUKxE:3BRNJZmsXGgroq
Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

agentteslacollectionkeyloggerpersistencespywarestealertrojan

behavioral2

agentteslacollectionkeyloggerpersistencespywarestealertrojan

© 2018-2024

Terms | Privacy