agenttesla | cce693672e91fa6a614729d0c1b9cdd96afa589ecd6c8156f5444f38b4edf213 | Triage

Submit
Reports

Overview

overview

Static

static

5

SOXB300658...DF.exe

windows7-x64

SOXB300658...DF.exe

windows10-2004-x64

Sharing

General

Target

SOXB300658290E512EF.PDF.exe
Size

1017KB
Sample

240521-nv861acd6s
MD5

300c66c99811ab658ca768bd2492af46
SHA1

a6111b2b83f1fb0d89113e68fbdeacb715b6f874
SHA256

cce693672e91fa6a614729d0c1b9cdd96afa589ecd6c8156f5444f38b4edf213
SHA512

1d303a81679ef7150bfff0c3300e42519132508fc916b19ce428123684a1119b85787e4993cb599f7f1d3e6a1a5e4c03f18447a88cddc8b292c95e3a2ec70720
SSDEEP

24576:OAHnh+eWsN3skA4RV1Hom2KXMmHaj9OnloMOBW5:5h+ZkldoPK8Yaj9omMOq

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

SOXB300658290E512EF.PDF.exe

Resource

win7-20240221-en

agenttesla collection keylogger spyware stealer trojan

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

SOXB300658290E512EF.PDF.exe

Resource

win10v2004-20240426-en

agenttesla collection keylogger spyware stealer trojan

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.corpsa.net
Port:
21
Username:
[email protected]
Password:
-E~O8rekW5UT

Targets

- Target
  
  SOXB300658290E512EF.PDF.exe
- Size
  
  1017KB
- MD5
  
  300c66c99811ab658ca768bd2492af46
- SHA1
  
  a6111b2b83f1fb0d89113e68fbdeacb715b6f874
- SHA256
  
  cce693672e91fa6a614729d0c1b9cdd96afa589ecd6c8156f5444f38b4edf213
- SHA512
  
  1d303a81679ef7150bfff0c3300e42519132508fc916b19ce428123684a1119b85787e4993cb599f7f1d3e6a1a5e4c03f18447a88cddc8b292c95e3a2ec70720
- SSDEEP
  
  24576:OAHnh+eWsN3skA4RV1Hom2KXMmHaj9OnloMOBW5:5h+ZkldoPK8Yaj9omMOq
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslacollectionkeyloggerspywarestealertrojan

behavioral2

agentteslacollectionkeyloggerspywarestealertrojan

© 2018-2024

Terms | Privacy