agenttesla | c82108c4e44fd4cf6a738fe0a9b7e0f48d7562cb9814ef9f3e6bc69baaa49d72 | Triage

Submit
Reports

Overview

overview

Static

static

7

svchost_protected.exe

windows7-x64

svchost_protected.exe

windows10-2004-x64

Sharing

General

Target

svchost_protected.exe
Size

7.6MB
Sample

240830-xptnss1ckm
MD5

4cfcc5d2726fae6a7d5ca823bcbc27f2
SHA1

104cd989cec2e3d44a8b4558c3607bf570c32a8f
SHA256

c82108c4e44fd4cf6a738fe0a9b7e0f48d7562cb9814ef9f3e6bc69baaa49d72
SHA512

5331aae68b8ae6d9131d08c1fbd756c1f0e0805ae7b23956deef7111026d17e024472a6f490cc7551d3a5a0d3b09d6726b894f033388a65710a9b079aabef2e7
SSDEEP

196608:yd2RtaSKkkPYelGUStVqoAENrwKW9I6hqRTJy+1OTNzLt:W2DqkkPYelGUzCtxFy+1ONLt

Score

10^/10

agenttesla discovery evasion keylogger spyware stealer themida trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

svchost_protected.exe

Resource

win7-20240705-en

agenttesla discovery evasion keylogger spyware stealer themida trojan

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

svchost_protected.exe

Resource

win10v2004-20240802-en

agenttesla discovery evasion keylogger spyware stealer themida trojan

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  svchost_protected.exe
- Size
  
  7.6MB
- MD5
  
  4cfcc5d2726fae6a7d5ca823bcbc27f2
- SHA1
  
  104cd989cec2e3d44a8b4558c3607bf570c32a8f
- SHA256
  
  c82108c4e44fd4cf6a738fe0a9b7e0f48d7562cb9814ef9f3e6bc69baaa49d72
- SHA512
  
  5331aae68b8ae6d9131d08c1fbd756c1f0e0805ae7b23956deef7111026d17e024472a6f490cc7551d3a5a0d3b09d6726b894f033388a65710a9b079aabef2e7
- SSDEEP
  
  196608:yd2RtaSKkkPYelGUStVqoAENrwKW9I6hqRTJy+1OTNzLt:W2DqkkPYelGUzCtxFy+1ONLt
Score

10^/10

agenttesla discovery evasion keylogger spyware stealer themida trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agenttesladiscoveryevasionkeyloggerspywarestealerthemidatrojan

behavioral2

agenttesladiscoveryevasionkeyloggerspywarestealerthemidatrojan

© 2018-2025

Terms | Privacy