agenttesla | c59d312b4ffe90f9d1240f87c7e97162827f5eb014f531f453bb36942fb78f6c | Triage

Submit
Reports

Overview

overview

Static

static

3

0f99b96d75...18.exe

windows7-x64

0f99b96d75...18.exe

windows10-2004-x64

Sharing

General

Target

0f99b96d7569977053c317aa457677ac_JaffaCakes118
Size

628KB
Sample

240328-zk9kkagh84
MD5

0f99b96d7569977053c317aa457677ac
SHA1

96298513d8dda6613f0bb3d938a7bd43f9405bf8
SHA256

c59d312b4ffe90f9d1240f87c7e97162827f5eb014f531f453bb36942fb78f6c
SHA512

e7c17a3dd478a71e6e6aafc81f505121ab116c1744ef8733e1adcda3eea9226f5fa8267c143e1f187ac579a8f5b67b25998d0325fad7b3e8ddcc386e81fa99b1
SSDEEP

12288:Boo0s4jHufGhvJMI8wpQoexxRot4abyMWKhuUA59rLVZcAiggQX9DIKx0:O7hJ8qjexxqt4xMWKhuPlZcAia9d

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

0f99b96d7569977053c317aa457677ac_JaffaCakes118.exe

Resource

win7-20240221-en

agenttesla collection keylogger spyware stealer trojan

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

0f99b96d7569977053c317aa457677ac_JaffaCakes118.exe

Resource

win10v2004-20240226-en

agenttesla collection keylogger spyware stealer trojan

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.rettberrg.com
Port:
587
Username:
ebuk@rettberrg.com
Password:
ka*g((D8

Targets

- Target
  
  0f99b96d7569977053c317aa457677ac_JaffaCakes118
- Size
  
  628KB
- MD5
  
  0f99b96d7569977053c317aa457677ac
- SHA1
  
  96298513d8dda6613f0bb3d938a7bd43f9405bf8
- SHA256
  
  c59d312b4ffe90f9d1240f87c7e97162827f5eb014f531f453bb36942fb78f6c
- SHA512
  
  e7c17a3dd478a71e6e6aafc81f505121ab116c1744ef8733e1adcda3eea9226f5fa8267c143e1f187ac579a8f5b67b25998d0325fad7b3e8ddcc386e81fa99b1
- SSDEEP
  
  12288:Boo0s4jHufGhvJMI8wpQoexxRot4abyMWKhuUA59rLVZcAiggQX9DIKx0:O7hJ8qjexxqt4xMWKhuPlZcAia9d
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

agentteslacollectionkeyloggerspywarestealertrojan

behavioral2

agentteslacollectionkeyloggerspywarestealertrojan

© 2018-2024

Terms | Privacy