agenttesla | d46ee1b6cb535f10569f32fd2cacd45e57604618acf9c9325b1a42c08a58501d | Triage

Submit
Reports

Overview

overview

Static

static

7

Loader.exe

windows7-x64

Loader.exe

windows10-2004-x64

Sharing

General

Target

Loader.exe
Size

7.2MB
Sample

240726-r9sdksyalb
MD5

36bf24717a8bb6d09ad89cf726aceb32
SHA1

df98d0381952971a6b1c025fa79d63b9de269fd9
SHA256

d46ee1b6cb535f10569f32fd2cacd45e57604618acf9c9325b1a42c08a58501d
SHA512

2d88e7125e62455091bce76867bd8e9118a0bf46ad70b62061e51da631dbdf5ecbe0069258dd36205d5961db0483b0a68287af89a40da9387ca256542fda6adb
SSDEEP

196608:aCkDGLYW9iMuxHUF7WhQ+5GvyEUNNwjsJiTVwjkOi0:Bkip6hQ+UvwJimp

Score

10^/10

agenttesla discovery evasion keylogger spyware stealer themida trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

Loader.exe

Resource

win7-20240705-en

agenttesla discovery evasion keylogger spyware stealer themida trojan

windows7-x64

16 signatures

150 seconds

Behavioral task

behavioral2

Sample

Loader.exe

Resource

win10v2004-20240704-en

agenttesla discovery evasion keylogger spyware stealer themida trojan

windows10-2004-x64

19 signatures

150 seconds

Malware Config

Targets

- Target
  
  Loader.exe
- Size
  
  7.2MB
- MD5
  
  36bf24717a8bb6d09ad89cf726aceb32
- SHA1
  
  df98d0381952971a6b1c025fa79d63b9de269fd9
- SHA256
  
  d46ee1b6cb535f10569f32fd2cacd45e57604618acf9c9325b1a42c08a58501d
- SHA512
  
  2d88e7125e62455091bce76867bd8e9118a0bf46ad70b62061e51da631dbdf5ecbe0069258dd36205d5961db0483b0a68287af89a40da9387ca256542fda6adb
- SSDEEP
  
  196608:aCkDGLYW9iMuxHUF7WhQ+5GvyEUNNwjsJiTVwjkOi0:Bkip6hQ+UvwJimp
Score

10^/10

agenttesla discovery evasion keylogger spyware stealer themida trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Virtualization/Sandbox Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

agenttesladiscoveryevasionkeyloggerspywarestealerthemidatrojan

behavioral2

agenttesladiscoveryevasionkeyloggerspywarestealerthemidatrojan

© 2018-2024

Terms | Privacy