agenttesla | 783c5a590d5e1577c23f3d48859faec4269c8d3b5d7535ce5113792675514204 | Triage

Sharing

General

Target

lava.zip
Size

50.6MB
Sample

240914-kn81wavgqn
MD5

22ea15e9e2b15ec209c39c67d5501544
SHA1

70d651509f651741d5696ef0ff71c246e8822fc5
SHA256

783c5a590d5e1577c23f3d48859faec4269c8d3b5d7535ce5113792675514204
SHA512

b737a2d1eaaf8280cf9a7ba7b8de8ebe3f1b2e353af94d3582e620926a5c71d64722a0a33645014cdf0bb77136e0f487a114f2430a687204fba67d154b92198b
SSDEEP

786432:AS8z/2LVMT91++JOWNQjocdwjvuO27GAvPHlIuJx0dGMtDwQRGvAaep7:ASW/2mxMDdwf2CYPKyfyR/n

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Malware Config

Targets

- Target
  
  2024 star of the night Api.dll
- Size
  
  19KB
- MD5
  
  f4e254e64c479347c9b56d28c4e9c0a7
- SHA1
  
  577db1a64d47f8d3b554db70f68e2127896504fc
- SHA256
  
  563477d2069f33f4bbb1f23cea57c980fc13e3e1baf06303e39a803f6e9d24da
- SHA512
  
  d73ec241a4103e376f10b2a0c1c291eb0fa7edc06895e529ed2a77ad61d596bf5edb02ba6f1f75212d2b68f6eee6a44ff17b9cd0fc46b82c9ad4284095b912f8
- SSDEEP
  
  384:jfPpRo5qV4udrBDpvxqhwAXuyIDCzfHbkkqJ8srNxVPv:Dxi24mxqhwIuozLYrN/Pv
Score

1^/10
behavioral1 behavioral2
- Target
  
  FastColoredTextBox.dll
- Size
  
  321KB
- MD5
  
  6f96d69c5fe9f94a5347ea79ae0a7f17
- SHA1
  
  99aa1e09b3e159954d2b48a6ca30c257bd6097f9
- SHA256
  
  2990de1f8c81c0306f721406926f261882c4fa1001180fe867e18dd0304aa129
- SHA512
  
  c71b3845904350842409ce0797bff964bda4cf2f1785719fd971d6cda23250e04c95a737adb5bb8e8fba80b4227edb6f6330b0ee91f1b89239aa8db818dfcd51
- SSDEEP
  
  6144:7eM+FI9qxcKpNOhUNagetTG5q1bPEsqmLD87eNT/9Jwa:iMnqxcKpNO/bseN39
Score

1^/10
behavioral3 behavioral4
- Target
  
  Guna.UI2.dll
- Size
  
  2.1MB
- MD5
  
  c97f23b52087cfa97985f784ea83498f
- SHA1
  
  d364618bec9cd6f8f5d4c24d3cc0f4c1a8e06b89
- SHA256
  
  e658e8a5616245dbe655e194b59f1bb704aaeafbd0925d6eebbe70555a638cdd
- SHA512
  
  ecfa83596f99afde9758d1142ff8b510a090cba6f42ba6fda8ca5e0520b658943ad85829a07bf17411e26e58432b74f05356f7eaeb3949a8834faa5de1a4f512
- SSDEEP
  
  49152:cvrqKk8q2gqi2OXCt6kuSw9g8PTNTN/23uxjPHEiCAjFcm:cvrqZr
Score

1^/10
behavioral5 behavioral6
- Target
  
  Leave.exe
- Size
  
  21KB
- MD5
  
  4f59c58bd4b78bc6b9b9c1cd1a5c84e4
- SHA1
  
  9a04d93617c649bb19675c6141a78ac48d7306f1
- SHA256
  
  63cbae517cdc43468f73c362dca6bd1d50cd5fefa4e317ed82fc464f7653f5bc
- SHA512
  
  21f38d5b4c126690f0bd6331b8b9bde340666f8b6c368a6775c59ba1567df754ef1928002d897a09ebded3bf03af8003ab538d7ba8360c296d30bbd2d4553f17
- SSDEEP
  
  384:59mO1MqaL3mFi/P5xsZyZbSJ0ULAgSXNp3G7LU7002hv+N0VL3LKLrbKHVt0vwOs:eX91AUr2m0pbWnKHcy2li1r5
Score

10^/10

discovery agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
behavioral7 behavioral8
- Target
  
  Shaakey-idfk12-09d89e6/main.exe
- Size
  
  22.3MB
- MD5
  
  01d47112d18f6fbac82ca624446c4979
- SHA1
  
  7e9158e9a09995e9381f3e6349bc827f8216910d
- SHA256
  
  8f793075f2fdd4dc2a4ef27b275c4efd83a5a8ef64295c40dc92b8dbaac71279
- SHA512
  
  9d8743578c336a13279b6af709ba7e73ed4236ebb0634c9df0c6228b9f164cf73d06898eedd0a9310ef1fb14686b2b893833167f1a4b21db963d07a8ca31c2d4
- SSDEEP
  
  393216:Wqil0KbTLzUj/TwsIs0DLSPB0MgNb3W7PBuhxJWjSHHax4:mlRze6+PB01lEZoCSHF
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral10 behavioral9
- Target
  
  api/CeleryIn.bin
- Size
  
  44KB
- MD5
  
  5216142196b083af82cb46de13d54d0d
- SHA1
  
  e324803daaa1d7f4af0ba59859bab15edbb2fcf1
- SHA256
  
  349cefc77e004237535143f1123f08d21cdbc15169fb7bbc234dabdac738c2f1
- SHA512
  
  21977d1a65583979759e3dc17cfd42083c50d0d933940812a6963620e0aab3f890ff0b7b146be14c49cc70a37864404896aba23b7f04fa19c6bbc83e43e8fa51
- SSDEEP
  
  384:nVdzew6q0MEe7Tc8cZO1D9WDPAK7cRjoTYVJa5LoVMmA2QdwB5bh1r:VYiXFcZkRc3JTYVJaoNA2jj
Score

1^/10
behavioral11 behavioral12
- Target
  
  api/CeleryInject.exe
- Size
  
  4.8MB
- MD5
  
  ed10dc5297ce06b1f2ac9be338813439
- SHA1
  
  e6423d50a5dab548b2d77799abfca9d6db0f83bd
- SHA256
  
  e97562123b7c059aec0e31a3bdc402f13e41e9f0ab38857b1adf948b350a8a94
- SHA512
  
  bc061587e29eca586c1f4a70cd4d7ee73b83b13642f763609af36cea6297917ac86bfca861fdc08113fd3107793ed9f93e7b9bdc8408b34cb1a0751482809a84
- SSDEEP
  
  49152:nJm4iNvgKzFKHLT48y3vPqAmDGjyAlqP53Ps9Ssudn1dnndn+dnMHJtk:JGI5HWeK
Score

1^/10
behavioral13 behavioral14
- Target
  
  bin/API.dll
- Size
  
  1.3MB
- MD5
  
  157fd035b2a344a94166d7db3756df0e
- SHA1
  
  f221d28c1deb80b4e8d9201226435aefce6b0f75
- SHA256
  
  8716c75aff75941711aff8770836f47eb9a254416089ef3571c6fc9a338b3009
- SHA512
  
  fad0174fbd22f58dd4fcdaad8378c214270b4faeaca64d9cb306f50e9316072a4c417c5723c4123b8bf94a3dba6ef4e3303ec60f4a2cf0c3a54d8ab375ea717d
- SSDEEP
  
  24576:ZqBSLRktEBl6blwTUMD4zB1VU2bFjYWR0pMQUAqLRAovh4bSAXVVRNRfMXZO:ZqBSLRkt8l6blSU//+2bFfvA1SQVVRNk
Score

1^/10
behavioral15 behavioral16
- Target
  
  main.exe
- Size
  
  25.8MB
- MD5
  
  4e956ac86ed8e55dbbe09f0a2c8006e5
- SHA1
  
  a9bb6e918e0405dcf92dc3d4e121c2c5eae7f00a
- SHA256
  
  f371c01e7e68b7bd05fb7f3f9c4dc76dc4107fad1f68c9a95157c52033a99533
- SHA512
  
  3368eadecc29c5f5835bb8059203469df43e6b3b59e5770f88e43bc905746a6e365b8c57afcdef4097bf2f03b44e381876f89e5e0e34923c5997f939a01381db
- SSDEEP
  
  786432:gZWBdpO3uVeBOGOO5EtcwySXy7KDNvyWK:gZWFOGztc+XyGpv
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral17 behavioral18

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

agenttesladiscoverykeyloggerspywarestealertrojan

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18