agenttesla | acf8e588808d06c6e5ab45187f753aa03a2a38a176a220749885bf1d5651c874 | Triage

Submit
Reports

Overview

overview

Static

static

3

e4376f9306...18.exe

windows7-x64

e4376f9306...18.exe

windows10-2004-x64

Sharing

General

Target

e4376f930649066f6616f4701e8793fe_JaffaCakes118
Size

819KB
Sample

240916-hjqmmatfqk
MD5

e4376f930649066f6616f4701e8793fe
SHA1

f3b69714acd37bdf5d0021d0ccca2dbd58a41dee
SHA256

acf8e588808d06c6e5ab45187f753aa03a2a38a176a220749885bf1d5651c874
SHA512

a978fa4d3fc086e64e6e8bfe4daf7103596bc9404df5ec8eb81b9607eee86e9b0ae9c3bdbdfaba8948f8fcb27a44cb47197c9992e2f8a33baec1f6566bb65263
SSDEEP

12288:RLfZIethKajTaWoj9p+SORQhcvqWC+ZqglbOlKOM99:7Ieth1a/PF/n4bX9

Score

10^/10

agenttesla discovery keylogger persistence spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

e4376f930649066f6616f4701e8793fe_JaffaCakes118.exe

Resource

win7-20240708-en

agenttesla discovery keylogger spyware stealer trojan

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral2

Sample

e4376f930649066f6616f4701e8793fe_JaffaCakes118.exe

Resource

win10v2004-20240802-en

agenttesla discovery keylogger persistence spyware stealer trojan

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.pars-science.ir
Port:
587
Username:
[email protected]
Password:
y&7nup,*CQLa

Targets

- Target
  
  e4376f930649066f6616f4701e8793fe_JaffaCakes118
- Size
  
  819KB
- MD5
  
  e4376f930649066f6616f4701e8793fe
- SHA1
  
  f3b69714acd37bdf5d0021d0ccca2dbd58a41dee
- SHA256
  
  acf8e588808d06c6e5ab45187f753aa03a2a38a176a220749885bf1d5651c874
- SHA512
  
  a978fa4d3fc086e64e6e8bfe4daf7103596bc9404df5ec8eb81b9607eee86e9b0ae9c3bdbdfaba8948f8fcb27a44cb47197c9992e2f8a33baec1f6566bb65263
- SSDEEP
  
  12288:RLfZIethKajTaWoj9p+SORQhcvqWC+ZqglbOlKOM99:7Ieth1a/PF/n4bX9
Score

10^/10

agenttesla discovery keylogger spyware stealer trojan persistence
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agenttesladiscoverykeyloggerspywarestealertrojan

behavioral2

agenttesladiscoverykeyloggerpersistencespywarestealertrojan

© 2018-2024

Terms | Privacy