agenttesla | 259040f5012aa4b24c7085ec185b1087d933b1d0ff45789608c3b5e6b1cfd0b7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c1bb31d98374c7aa25240700274c73d3.bin
Size

751KB
Sample

240607-dhv4hahf99
MD5

a1e6888fa03d718f108b6fa4f8e876f1
SHA1

a8ef4724c9c0011dc421f9afa11d03da20a8932a
SHA256

259040f5012aa4b24c7085ec185b1087d933b1d0ff45789608c3b5e6b1cfd0b7
SHA512

aa01626efc3f4e7b356fd193aa5f9aca96d12828a6752d85df04cacca9674a46289f90ed479b373cd6230e8b1ff0ab41867179943f59f0ef4cbf29f621a4c952
SSDEEP

12288:te2L2l5xi5eNFtAf1Mu828I8K1g7S2wIjFnEAvRilnuAlBdKP1hlrqIJwGs7tjQA:h0xuedN928WgQIjFnESRilnuAlKP3XyT

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  d6926f61e959b5d6285126d73e0c152ae64193e0b7e3e189bb3b04d619be0912.exe
- Size
  
  1.1MB
- MD5
  
  c1bb31d98374c7aa25240700274c73d3
- SHA1
  
  f4e222bc3d2c6d0e794116c890b5c93af69bc92e
- SHA256
  
  d6926f61e959b5d6285126d73e0c152ae64193e0b7e3e189bb3b04d619be0912
- SHA512
  
  7889d9b2f472653d90994f56fc5544b3c1c468fb92d3f78296f814c74b1c68604105943c381ac45259b7f656b10a86a6b02439ff33687cd658a7758b753b35a9
- SSDEEP
  
  24576:yAHnh+eWsN3skA4RV1Hom2KXMmHaW3FbbNzfT2dwgy1ygbas5:1h+ZkldoPK8YaWlbNzfW7Ip
Score

10^/10

agenttesla keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslakeyloggerpersistencespywarestealertrojan

behavioral2

agentteslakeyloggerpersistencespywarestealertrojan