agenttesla | 38f33fb3fccb12a2fca3dd5f8cd394470bf9db64948c76c205454fed8a7a78e6 | Triage

Submit
Reports

Overview

overview

Static

static

3

e52d9eff1f...18.exe

windows7-x64

e52d9eff1f...18.exe

windows10-2004-x64

Sharing

General

Target

e52d9eff1f9c458308401b6a3b86be86_JaffaCakes118
Size

544KB
Sample

240916-t7eqtaycjq
MD5

e52d9eff1f9c458308401b6a3b86be86
SHA1

44a055d31a46cbb8741cd17ce10b431743e84f72
SHA256

38f33fb3fccb12a2fca3dd5f8cd394470bf9db64948c76c205454fed8a7a78e6
SHA512

43b827e59dd4cbee30c154d1cb280bac575bb477b416d1c038e296ee1290c572139b815db49b3934d8f7672f2c7a6a1bcd583c4f091bc5e4418a4fb8da85392a
SSDEEP

12288:1PdHBc0aREtpHkEZx/jjPrAvcUGXBwM5/iZ:jHavREtpHPZRjnAvhGX6MO

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

e52d9eff1f9c458308401b6a3b86be86_JaffaCakes118.exe

Resource

win7-20240903-en

agenttesla discovery keylogger spyware stealer trojan

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral2

Sample

e52d9eff1f9c458308401b6a3b86be86_JaffaCakes118.exe

Resource

win10v2004-20240802-en

agenttesla discovery keylogger spyware stealer trojan

windows10-2004-x64

7 signatures

150 seconds

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot1646835441:AAHIh3Hnz82ZJP3qFuiRkuX3NPxmTGZc2sY/sendDocument

Targets

- Target
  
  e52d9eff1f9c458308401b6a3b86be86_JaffaCakes118
- Size
  
  544KB
- MD5
  
  e52d9eff1f9c458308401b6a3b86be86
- SHA1
  
  44a055d31a46cbb8741cd17ce10b431743e84f72
- SHA256
  
  38f33fb3fccb12a2fca3dd5f8cd394470bf9db64948c76c205454fed8a7a78e6
- SHA512
  
  43b827e59dd4cbee30c154d1cb280bac575bb477b416d1c038e296ee1290c572139b815db49b3934d8f7672f2c7a6a1bcd583c4f091bc5e4418a4fb8da85392a
- SSDEEP
  
  12288:1PdHBc0aREtpHkEZx/jjPrAvcUGXBwM5/iZ:jHavREtpHPZRjnAvhGX6MO
Score

10^/10

agenttesla discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agenttesladiscoverykeyloggerspywarestealertrojan

behavioral2

agenttesladiscoverykeyloggerspywarestealertrojan

© 2018-2024

Terms | Privacy