agenttesla | bc90563815f99d029a634bcefabd36454c7e56ea08614ecd37fb4c22b7bc71fd | Triage

Submit
Reports

Overview

overview

Static

static

3

845a5f8a14...18.exe

windows7-x64

845a5f8a14...18.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target

845a5f8a14c888ca950289cfd81f9702_JaffaCakes118
Size

585KB
Sample

240810-b5rngszfkl
MD5

845a5f8a14c888ca950289cfd81f9702
SHA1

6c83e9ee613bce1ed166133f6e9ab937c03d5dc0
SHA256

bc90563815f99d029a634bcefabd36454c7e56ea08614ecd37fb4c22b7bc71fd
SHA512

fb74900e060698fc9423d5b71fd2c00578579fe03ed44cbed79588637a3b9499005593b5692ccbb7a0da8cd8e522a0fa3520486b5b67cd2b5f91be1e58a2b9bb
SSDEEP

12288:4rkcSQrld21fNlRUudoc9wgYpxO2V7VnqB9r33hTSdBBBKZpzawVTMsM:4LPOjdoAYpxOk790r3JSyZ1tT

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

845a5f8a14c888ca950289cfd81f9702_JaffaCakes118.exe

Resource

win7-20240704-en

agenttesla discovery keylogger spyware stealer trojan

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral2

Sample

845a5f8a14c888ca950289cfd81f9702_JaffaCakes118.exe

Resource

win10v2004-20240802-en

agenttesla discovery keylogger spyware stealer trojan

windows10-2004-x64

7 signatures

150 seconds

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.curidesigner.com/
Port:
21
Username:
[email protected]
Password:
boygirl123456

Targets

- Target
  
  845a5f8a14c888ca950289cfd81f9702_JaffaCakes118
- Size
  
  585KB
- MD5
  
  845a5f8a14c888ca950289cfd81f9702
- SHA1
  
  6c83e9ee613bce1ed166133f6e9ab937c03d5dc0
- SHA256
  
  bc90563815f99d029a634bcefabd36454c7e56ea08614ecd37fb4c22b7bc71fd
- SHA512
  
  fb74900e060698fc9423d5b71fd2c00578579fe03ed44cbed79588637a3b9499005593b5692ccbb7a0da8cd8e522a0fa3520486b5b67cd2b5f91be1e58a2b9bb
- SSDEEP
  
  12288:4rkcSQrld21fNlRUudoc9wgYpxO2V7VnqB9r33hTSdBBBKZpzawVTMsM:4LPOjdoAYpxOk790r3JSyZ1tT
Score

10^/10

agenttesla discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agenttesladiscoverykeyloggerspywarestealertrojan

behavioral2

agenttesladiscoverykeyloggerspywarestealertrojan

© 2018-2025

Terms | Privacy