agenttesla | 859d7c1d836ca442f3d913a7293703b728d7241ef83ad5d8ead7303ed590fd21 | Triage

Submit
Reports

Overview

overview

Static

static

3

PO CPWPKL-1901088.exe

windows7-x64

PO CPWPKL-1901088.exe

windows10-2004-x64

Sharing

General

Target

1ede35fd9d34dc75f5c8a60194bd79f6_JaffaCakes118
Size

472KB
Sample

240329-lvk33afb33
MD5

1ede35fd9d34dc75f5c8a60194bd79f6
SHA1

9e73c3b2bba0a0e31b1d5156875c31eaab89e689
SHA256

859d7c1d836ca442f3d913a7293703b728d7241ef83ad5d8ead7303ed590fd21
SHA512

d3574c204eec0c00df3ac5e63279afcba4fd9a355ccc030d6412b4e6beca5a7a33947a53a0864c8b1cf47f7b70b0e8522e236e03fedb187c215510af370b5359
SSDEEP

6144:OfGiNTeMLmK6DWOYll1UP2z9gYuMiSPdS0r3jnahy/tuHv4IW7YiLkijrktL9Alp:O5KSFemllGYnVRbjnaHD7c/VhcOFM6

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

PO CPWPKL-1901088.exe

Resource

win7-20240221-en

agenttesla collection keylogger persistence spyware stealer trojan

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

PO CPWPKL-1901088.exe

Resource

win10v2004-20240319-en

agenttesla collection keylogger persistence spyware stealer trojan

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
sg2plcpnl0023.prod.sin2.secureserver.net
Port:
587
Username:
[email protected]
Password:
User@40378

Targets

- Target
  
  PO CPWPKL-1901088.exe
- Size
  
  704KB
- MD5
  
  1a19bb4c028d7943e65587dc94f38ffc
- SHA1
  
  7a0a462391f53d3421862125b944b1cef9ae988e
- SHA256
  
  dbf947a367cfe28cc7e5e33af9d8aa7fe3166d74d787200b1bcce777ac65efcf
- SHA512
  
  d70f384366ed59e53037547c1390aab369a7840544c11ee4b6a330751f7454be20f76c9e9be0f135ee3b3a6214fdd322d97bccbdd16b1c9b970fd667694fb601
- SSDEEP
  
  12288:wgxRTlOaEQFD6m7kyR3HrHeu0YuizEEwreL:jOaRFHkGHr+u5EE4
Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

agentteslacollectionkeyloggerpersistencespywarestealertrojan

behavioral2

agentteslacollectionkeyloggerpersistencespywarestealertrojan

© 2018-2024

Terms | Privacy