agenttesla | 4a72aaab512d5d03ad760d8b7fed290ec6b59670f40324fb05c446cb1eebbac2 | Triage

Submit
Reports

Overview

overview

Static

static

3

4a72aaab51...c2.exe

windows7-x64

4a72aaab51...c2.exe

windows10-2004-x64

1

Sharing

General

Target

4a72aaab512d5d03ad760d8b7fed290ec6b59670f40324fb05c446cb1eebbac2.exe
Size

1.2MB
Sample

240522-bxkvzagc5v
MD5

afaa642fd4cfb48f82417aa964fb123f
SHA1

4853e9b86c0731f91b2007d1397851bdf4e88b6d
SHA256

4a72aaab512d5d03ad760d8b7fed290ec6b59670f40324fb05c446cb1eebbac2
SHA512

21a970b985d89c27a606140dac2b4cb0161a881b32e263ee786fe07206fc76a010b634de225ee10261a3b1c10339a1041eea2a0c21cdcc7f1b17459a4da50649
SSDEEP

24576:TFva+LnIPzH6s5K4Z3L8efLG9HstTkmsdsnC7MerGYO0k:p0eM3LdS9Mis6MexM

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

4a72aaab512d5d03ad760d8b7fed290ec6b59670f40324fb05c446cb1eebbac2.exe

Resource

win7-20240221-en

agenttesla collection keylogger spyware stealer trojan

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

4a72aaab512d5d03ad760d8b7fed290ec6b59670f40324fb05c446cb1eebbac2.exe

Resource

win10v2004-20240226-en

windows10-2004-x64

0 signatures

150 seconds

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.svetigeorgije.co.rs
Port:
21
Username:
[email protected]
Password:
4c5H&b2whkD9

Targets

- Target
  
  4a72aaab512d5d03ad760d8b7fed290ec6b59670f40324fb05c446cb1eebbac2.exe
- Size
  
  1.2MB
- MD5
  
  afaa642fd4cfb48f82417aa964fb123f
- SHA1
  
  4853e9b86c0731f91b2007d1397851bdf4e88b6d
- SHA256
  
  4a72aaab512d5d03ad760d8b7fed290ec6b59670f40324fb05c446cb1eebbac2
- SHA512
  
  21a970b985d89c27a606140dac2b4cb0161a881b32e263ee786fe07206fc76a010b634de225ee10261a3b1c10339a1041eea2a0c21cdcc7f1b17459a4da50649
- SSDEEP
  
  24576:TFva+LnIPzH6s5K4Z3L8efLG9HstTkmsdsnC7MerGYO0k:p0eM3LdS9Mis6MexM
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Detect packed .NET executables. Mostly AgentTeslaV4.
- Detects executables packed with or use KoiVM
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

agentteslacollectionkeyloggerspywarestealertrojan

behavioral2

© 2018-2024

Terms | Privacy