agenttesla | 02f4632c2c5fcee495ab78d491e8610c95ca809912eb36abee2d8a2ba4109e57 | Triage

Submit
Reports

Overview

overview

Static

static

3

sale order.exe

windows7-x64

sale order.exe

windows10-2004-x64

Sharing

General

Target

f88ddb88720fd2124f58bf8df6d8b2eb_JaffaCakes118
Size

359KB
Sample

240418-xkt4rsdb3t
MD5

f88ddb88720fd2124f58bf8df6d8b2eb
SHA1

94bf59a6dade60a17ab60b629b735da6adbc671e
SHA256

02f4632c2c5fcee495ab78d491e8610c95ca809912eb36abee2d8a2ba4109e57
SHA512

c7596f24c13652f76d7cd12a21a0170e7b73c0e2537532a04abaacbf603ae3674492fa2192839e05bb53f82761617bde9c6541b4eddbe44262446ed6112babe6
SSDEEP

6144:KtlKUl1V/nTV94eUF8Lrc8Kojt6MI2ovSvFoMUHTNBXA8jRG1X55BkjdojEe4uvn:KtlKegzJBKgatoLBveXLBkjdojYuvs2

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

sale order.exe

Resource

win7-20240221-en

agenttesla collection keylogger persistence spyware stealer trojan

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

sale order.exe

Resource

win10v2004-20240412-en

agenttesla collection keylogger persistence spyware stealer trojan

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
sg2plcpnl0023.prod.sin2.secureserver.net
Port:
587
Username:
nbsupports@seshsupports.com
Password:
User@40378

Targets

- Target
  
  sale order.exe
- Size
  
  376KB
- MD5
  
  9d3fe8ed9fd927c91dd268f70a4c20b9
- SHA1
  
  0f0fe91255fd8af65bc2c03eb4ac63c888e600c9
- SHA256
  
  81c6ab8a5c8ea969d37b9b55d052cf8b352109f1d7e85e1115570f54e542b7c2
- SHA512
  
  f10468df2a885d3f3141280721d9365d72e91bcfb5d97ac6cf7ea3399c603da1c23a62a34c6d9801ca835e3ee46b050a1047dc3ab53680603316d93dc749f63e
- SSDEEP
  
  6144:wWOdWnLnJFNN1QT65Ib/Z2yNUHJ+UU+hektHJuFqBR4iAuqaBh86RqfxtmgYFgbH:wW+WtFH1Qd/ZDVUU+YkPTBR47+Bh86M9
Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

agentteslacollectionkeyloggerpersistencespywarestealertrojan

behavioral2

agentteslacollectionkeyloggerpersistencespywarestealertrojan

© 2018-2024

Terms | Privacy