agenttesla | 7fd0b00c630f29f370623f698cb81c67960f1e7c8b6954c1a5c451fd5e1a4d06 | Triage

Submit
Reports

Overview

overview

Static

static

5

30% SWIFT ...DF.exe

windows7-x64

30% SWIFT ...DF.exe

windows10-2004-x64

Sharing

General

Target

30% SWIFT COPY DOWN PAYMENT-PDF.exe
Size

1.0MB
Sample

241002-grfxqavape
MD5

66110becc4f6d2fb92e1de3e628f5dce
SHA1

0a05265eea556d81f46173242b760ce2e7b99faa
SHA256

7fd0b00c630f29f370623f698cb81c67960f1e7c8b6954c1a5c451fd5e1a4d06
SHA512

db1b062d29e243cde4b8c1df9696cf0e79b90b9119e2f1b8d03d91976a99de8bb510057e59d62d44ac29275303c6aa2a2a32296a843749d7a400843de7cf6241
SSDEEP

24576:uCdxte/80jYLT3U1jfsWafjLKNCA1WxNs3ZW/baQ:nw80cTsjkWafjeNH1WxNs3i

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

30% SWIFT COPY DOWN PAYMENT-PDF.exe

Resource

win7-20240903-en

agenttesla discovery keylogger spyware stealer trojan

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

30% SWIFT COPY DOWN PAYMENT-PDF.exe

Resource

win10v2004-20240802-en

agenttesla discovery keylogger spyware stealer trojan

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.zqamcx.com
Port:
587
Username:
[email protected]
Password:
Methodman991
Email To:
[email protected]

Targets

- Target
  
  30% SWIFT COPY DOWN PAYMENT-PDF.exe
- Size
  
  1.0MB
- MD5
  
  66110becc4f6d2fb92e1de3e628f5dce
- SHA1
  
  0a05265eea556d81f46173242b760ce2e7b99faa
- SHA256
  
  7fd0b00c630f29f370623f698cb81c67960f1e7c8b6954c1a5c451fd5e1a4d06
- SHA512
  
  db1b062d29e243cde4b8c1df9696cf0e79b90b9119e2f1b8d03d91976a99de8bb510057e59d62d44ac29275303c6aa2a2a32296a843749d7a400843de7cf6241
- SSDEEP
  
  24576:uCdxte/80jYLT3U1jfsWafjLKNCA1WxNs3ZW/baQ:nw80cTsjkWafjeNH1WxNs3i
Score

10^/10

agenttesla discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agenttesladiscoverykeyloggerspywarestealertrojan

behavioral2

agenttesladiscoverykeyloggerspywarestealertrojan

© 2018-2025

Terms | Privacy