agenttesla | f4008d16e598db2a35512ca619aa47a5434e177e5be16323378fd86715002808 | Triage

Submit
Reports

Overview

overview

Static

static

3

170b650b89...18.exe

windows7-x64

170b650b89...18.exe

windows10-2004-x64

7

$PLUGINSDI...vq.dll

windows7-x64

3

$PLUGINSDI...vq.dll

windows10-2004-x64

3

Sharing

General

Target

170b650b89eb3f88732366ca582cb976_JaffaCakes118
Size

341KB
Sample

240329-dtw5yagd4y
MD5

170b650b89eb3f88732366ca582cb976
SHA1

b76899209d61e00e567d6bfa1140b6455f28b9c6
SHA256

f4008d16e598db2a35512ca619aa47a5434e177e5be16323378fd86715002808
SHA512

562b57205bee65a96ff1e8eabbe64e0f0bb5e1390ba8b6354691a7875ef819b87742a18dfc482e62930cf2f6f5f0d3d517a3da4d67d8e5a55bebc609c10ccf18
SSDEEP

6144:GBlL/LNEppNBYRU1P/PMSnxT0SBCGbyVpEhcHEytf7anFF:EBm77RnxT0SBCGQon7

Score

10^/10

agenttesla keylogger spyware stealer trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe

Resource

win7-20240221-en

agenttesla keylogger spyware stealer trojan

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe

Resource

win10v2004-20240226-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral3

Sample

$PLUGINSDIR/misckvq.dll

Resource

win7-20240220-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral4

Sample

$PLUGINSDIR/misckvq.dll

Resource

win10v2004-20240226-en

windows10-2004-x64

2 signatures

150 seconds

Malware Config

Targets

- Target
  
  170b650b89eb3f88732366ca582cb976_JaffaCakes118
- Size
  
  341KB
- MD5
  
  170b650b89eb3f88732366ca582cb976
- SHA1
  
  b76899209d61e00e567d6bfa1140b6455f28b9c6
- SHA256
  
  f4008d16e598db2a35512ca619aa47a5434e177e5be16323378fd86715002808
- SHA512
  
  562b57205bee65a96ff1e8eabbe64e0f0bb5e1390ba8b6354691a7875ef819b87742a18dfc482e62930cf2f6f5f0d3d517a3da4d67d8e5a55bebc609c10ccf18
- SSDEEP
  
  6144:GBlL/LNEppNBYRU1P/PMSnxT0SBCGbyVpEhcHEytf7anFF:EBm77RnxT0SBCGQon7
Score

10^/10

agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/misckvq.dll
- Size
  
  32KB
- MD5
  
  71455ae5bee5d2dc77c1c86f0ff4a9aa
- SHA1
  
  30aba60427c693656d8d76cbdf257c033284f1c2
- SHA256
  
  10d7db2ec1fa897b98373589c629e14b938d81a952bc33c32d60aea1522f86d6
- SHA512
  
  a4e0a98ef162bf28059af238b25f696d1dd0e07cc30337968f15ebb802ecd487c9f4ada2ee441052a24e66ba4f9dbf6beb307e9a7f65495156270468fb2c699a
- SSDEEP
  
  384:Po2TnKv+shzPOOJtWAV+c49ZOcgxjtvSG+G+4HBQ/rgaqYt3dnrAeWU9ONIu6YMl:A2Eh6FLOcXoa/rga9tNnrA7N7AK
Score

3^/10
behavioral3 behavioral4

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

agentteslakeyloggerspywarestealertrojan

behavioral2

behavioral3

behavioral4

© 2018-2024

Terms | Privacy