agenttesla | 4faf605050ae11ae07281fef9fd15f8ea2669c3d028355a1f6b4d478572da015 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

a38a687724...18.exe

windows7-x64

a38a687724...18.exe

windows10-2004-x64

Sharing

General

Target

a38a68772404966ad8affbda6c025b82_JaffaCakes118
Size

540KB
Sample

240817-wgrzka1fqj
MD5

a38a68772404966ad8affbda6c025b82
SHA1

1e3dd48805525f360e27496f21f400d75540c8c2
SHA256

4faf605050ae11ae07281fef9fd15f8ea2669c3d028355a1f6b4d478572da015
SHA512

dba1fa3118bf550e0a93f9dab99759560cd610de6850a4ffb3a6d1d3716bb3204becf96af480906869c5246b13cf2af9a80f9d3cd688bb8461035400c8a15faf
SSDEEP

6144:2+RT7CqbBWgimJQlANC7RyLpeB4bzMbnOnLbvnaj8DwdEcVkuoNPSxvfKpvzGDo5:2ACqc3mJME8EeBIa0bvcEpxSU1GmvZ

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

a38a68772404966ad8affbda6c025b82_JaffaCakes118.exe

Resource

win7-20240708-en

agenttesla discovery keylogger spyware stealer trojan

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral2

Sample

a38a68772404966ad8affbda6c025b82_JaffaCakes118.exe

Resource

win10v2004-20240802-en

agenttesla discovery keylogger spyware stealer trojan

windows10-2004-x64

7 signatures

150 seconds

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.renlk.me
Port:
587
Username:
[email protected]
Password:
j*E@Hj}RaXJb

Targets

- Target
  
  a38a68772404966ad8affbda6c025b82_JaffaCakes118
- Size
  
  540KB
- MD5
  
  a38a68772404966ad8affbda6c025b82
- SHA1
  
  1e3dd48805525f360e27496f21f400d75540c8c2
- SHA256
  
  4faf605050ae11ae07281fef9fd15f8ea2669c3d028355a1f6b4d478572da015
- SHA512
  
  dba1fa3118bf550e0a93f9dab99759560cd610de6850a4ffb3a6d1d3716bb3204becf96af480906869c5246b13cf2af9a80f9d3cd688bb8461035400c8a15faf
- SSDEEP
  
  6144:2+RT7CqbBWgimJQlANC7RyLpeB4bzMbnOnLbvnaj8DwdEcVkuoNPSxvfKpvzGDo5:2ACqc3mJME8EeBIa0bvcEpxSU1GmvZ
Score

10^/10

agenttesla discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agenttesladiscoverykeyloggerspywarestealertrojan

behavioral2

agenttesladiscoverykeyloggerspywarestealertrojan

© 2018-2025

Terms | Privacy