agenttesla | f87bef1ec7a4e68e8a9d2765a5fbfe2e0a66144a1efab71af82caad271654ee2 | Triage

Submit
Reports

Overview

overview

Static

static

3

ea3e505903...18.exe

windows7-x64

ea3e505903...18.exe

windows10-2004-x64

Sharing

General

Target

ea3e5059033a6fd09d408317553171ea_JaffaCakes118
Size

952KB
Sample

240919-anglhs1bqd
MD5

ea3e5059033a6fd09d408317553171ea
SHA1

cc8fd5a89265ae21677f3cb2bd31d3491d0e9b94
SHA256

f87bef1ec7a4e68e8a9d2765a5fbfe2e0a66144a1efab71af82caad271654ee2
SHA512

4b9b18b5fdfb863e49bb7e356dba7ec04fef494a499b436cde83f9dfdc05b4040a8f014d16e4e5274974475ce41c698759cbe10bce7d1d8efd6f6725cb81ea9a
SSDEEP

24576:M5AsZjqYVU+wkxX2vQsPFPjvZ9Xnbc9mj:UZjqYlBQPj/Xnbomj

Score

10^/10

agenttesla discovery keylogger persistence spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

ea3e5059033a6fd09d408317553171ea_JaffaCakes118.exe

Resource

win7-20240704-en

agenttesla discovery keylogger persistence spyware stealer trojan

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

ea3e5059033a6fd09d408317553171ea_JaffaCakes118.exe

Resource

win10v2004-20240802-en

agenttesla discovery keylogger persistence spyware stealer trojan

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.flagmonkey.com.au
Port:
587
Username:
[email protected]
Password:
Enter@222F

Targets

- Target
  
  ea3e5059033a6fd09d408317553171ea_JaffaCakes118
- Size
  
  952KB
- MD5
  
  ea3e5059033a6fd09d408317553171ea
- SHA1
  
  cc8fd5a89265ae21677f3cb2bd31d3491d0e9b94
- SHA256
  
  f87bef1ec7a4e68e8a9d2765a5fbfe2e0a66144a1efab71af82caad271654ee2
- SHA512
  
  4b9b18b5fdfb863e49bb7e356dba7ec04fef494a499b436cde83f9dfdc05b4040a8f014d16e4e5274974475ce41c698759cbe10bce7d1d8efd6f6725cb81ea9a
- SSDEEP
  
  24576:M5AsZjqYVU+wkxX2vQsPFPjvZ9Xnbc9mj:UZjqYlBQPj/Xnbomj
Score

10^/10

agenttesla discovery keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agenttesladiscoverykeyloggerpersistencespywarestealertrojan

behavioral2

agenttesladiscoverykeyloggerpersistencespywarestealertrojan

© 2018-2024

Terms | Privacy