agenttesla | 34686435161bf43bd4c33df68a733b72ac73c24e5cd1d8fa473a7f55c373ab70 | Triage

Submit
Reports

Overview

overview

Static

static

5

3468643516...70.exe

windows7-x64

3468643516...70.exe

windows10-2004-x64

Sharing

General

Target

34686435161bf43bd4c33df68a733b72ac73c24e5cd1d8fa473a7f55c373ab70.exe
Size

1.2MB
Sample

240912-hd8k9awcmq
MD5

7133ab55e31ea1b16b141a561d5c3b27
SHA1

f08bf25e27b467460a5fecfa421c0555d4c88616
SHA256

34686435161bf43bd4c33df68a733b72ac73c24e5cd1d8fa473a7f55c373ab70
SHA512

7d54f51c80f3e3ab3a1b86176d22c49241bfa0bd24b2ec81c38ad193c4491cd46dc55aedf410c5ce5b69fc634fb92966ac6dda4353dda146ac43f9072bcb9697
SSDEEP

24576:C4lavt0LkLL9IMixoEgea6RyGw86lPCEYq9MmCS:1kwkn9IMHea6RRw8u69aPCS

Score

10^/10

agenttesla collection credential_access discovery keylogger spyware stealer trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

34686435161bf43bd4c33df68a733b72ac73c24e5cd1d8fa473a7f55c373ab70.exe

Resource

win7-20240903-en

agenttesla collection credential_access discovery keylogger spyware stealer trojan

windows7-x64

16 signatures

150 seconds

Behavioral task

behavioral2

Sample

34686435161bf43bd4c33df68a733b72ac73c24e5cd1d8fa473a7f55c373ab70.exe

Resource

win10v2004-20240802-en

agenttesla collection credential_access discovery keylogger spyware stealer trojan

windows10-2004-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  34686435161bf43bd4c33df68a733b72ac73c24e5cd1d8fa473a7f55c373ab70.exe
- Size
  
  1.2MB
- MD5
  
  7133ab55e31ea1b16b141a561d5c3b27
- SHA1
  
  f08bf25e27b467460a5fecfa421c0555d4c88616
- SHA256
  
  34686435161bf43bd4c33df68a733b72ac73c24e5cd1d8fa473a7f55c373ab70
- SHA512
  
  7d54f51c80f3e3ab3a1b86176d22c49241bfa0bd24b2ec81c38ad193c4491cd46dc55aedf410c5ce5b69fc634fb92966ac6dda4353dda146ac43f9072bcb9697
- SSDEEP
  
  24576:C4lavt0LkLL9IMixoEgea6RyGw86lPCEYq9MmCS:1kwkn9IMHea6RRw8u69aPCS
Score

10^/10

agenttesla collection credential_access discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslacollectioncredential_accessdiscoverykeyloggerspywarestealertrojan

behavioral2

agentteslacollectioncredential_accessdiscoverykeyloggerspywarestealertrojan

© 2018-2024

Terms | Privacy