agenttesla | 191d5be451e6dfe59a04142c04f9becdd4e4595742cb30a212a530efdf990926 | Triage

Submit
Reports

Overview

overview

Static

static

3

SWIFT CODE.exe

windows7-x64

SWIFT CODE.exe

windows10-2004-x64

Sharing

General

Target

2c6b9917962d7dcd200fdb0669d187e7_JaffaCakes118
Size

417KB
Sample

240329-zj3qmaaa96
MD5

2c6b9917962d7dcd200fdb0669d187e7
SHA1

a00f3f3e9f4db9fe882c5a02d93152cf1aa5628e
SHA256

191d5be451e6dfe59a04142c04f9becdd4e4595742cb30a212a530efdf990926
SHA512

a0ae7623b64b90bb94785c51cdc60a9f47431fa91d91a1bf4f99b2f8462bbeb58bdecea1bfe39f2ab73d061c2eeede1d453658353aaa6cda8122f22c5de6e811
SSDEEP

12288:rr+sBhjEyQoEfjMoAMEEq6rQTt4+MffMAr+b7BBYj50Wz:/+C4fjkM06sJdAr+fBu9z

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

SWIFT CODE.exe

Resource

win7-20240319-en

agenttesla collection keylogger persistence spyware stealer trojan

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

SWIFT CODE.exe

Resource

win10v2004-20240226-en

agenttesla collection keylogger persistence spyware stealer trojan

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
sg2plcpnl0023.prod.sin2.secureserver.net
Port:
587
Username:
[email protected]
Password:
User@40378

Targets

- Target
  
  SWIFT CODE.exe
- Size
  
  577KB
- MD5
  
  52cf290a22e736a7c8647aec1aad7244
- SHA1
  
  0ac082a46330d2659947420ddcd79d6e4c21862d
- SHA256
  
  f4f5e820b5256651b441c484c16a5b1155a679e1fc4182f2e5aa086866a8fc18
- SHA512
  
  d6f8eabe8c367d45d016bb142ce33f4bbe62f84793d243ae491a93266d25faee8b535a3a490de68ab212fe3c6da038379ef2ca7129e50fb11e506e190bf0fe3d
- SSDEEP
  
  12288:YuybE7SqXphXpBGB5P9lXLS8/P2NVS/A5TspXSB+gJU6:ryA7Sup1pg/juYeNeAFFBm6
Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

agentteslacollectionkeyloggerpersistencespywarestealertrojan

behavioral2

agentteslacollectionkeyloggerpersistencespywarestealertrojan

© 2018-2024

Terms | Privacy