agenttesla | b1288d6b5330d9bb5e398c328f22d4d6c4792cf73e347e5a74ee4180f8595776 | Triage

Submit
Reports

Overview

overview

Static

static

3

169aeadfd0...18.exe

windows7-x64

169aeadfd0...18.exe

windows10-2004-x64

Sharing

General

Target

169aeadfd0298a112ff8fdfaf129ed52_JaffaCakes118
Size

903KB
Sample

241005-hm2jas1fmk
MD5

169aeadfd0298a112ff8fdfaf129ed52
SHA1

d9ee989ac4c08413c27c79f7ab0fe453533042a6
SHA256

b1288d6b5330d9bb5e398c328f22d4d6c4792cf73e347e5a74ee4180f8595776
SHA512

4e8f48a8f6a822cf9558d12189952b62a24ed53143b321b946d18bae552ff7fb40a383f862419cebcf064bd393223aabf6d55608e7b64ea34ebb8c8fbddd7d9c
SSDEEP

12288:wKjNqzzx4opIccNuAMVHEkMffI7yO8ZG3q+8rK9OBtYG/8gSyVHK7zbizKboZT0B:P0vx4UKuDVHz4O2rK9OB2iYYKboy7

Score

10^/10

agenttesla collection credential_access discovery keylogger persistence spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

169aeadfd0298a112ff8fdfaf129ed52_JaffaCakes118.exe

Resource

win7-20240903-en

agenttesla collection credential_access discovery keylogger persistence spyware stealer trojan

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

169aeadfd0298a112ff8fdfaf129ed52_JaffaCakes118.exe

Resource

win10v2004-20240802-en

agenttesla collection credential_access discovery keylogger persistence spyware stealer trojan

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.priserveinfra.com
Port:
587
Username:
[email protected]
Password:
oppipl121019

Targets

- Target
  
  169aeadfd0298a112ff8fdfaf129ed52_JaffaCakes118
- Size
  
  903KB
- MD5
  
  169aeadfd0298a112ff8fdfaf129ed52
- SHA1
  
  d9ee989ac4c08413c27c79f7ab0fe453533042a6
- SHA256
  
  b1288d6b5330d9bb5e398c328f22d4d6c4792cf73e347e5a74ee4180f8595776
- SHA512
  
  4e8f48a8f6a822cf9558d12189952b62a24ed53143b321b946d18bae552ff7fb40a383f862419cebcf064bd393223aabf6d55608e7b64ea34ebb8c8fbddd7d9c
- SSDEEP
  
  12288:wKjNqzzx4opIccNuAMVHEkMffI7yO8ZG3q+8rK9OBtYG/8gSyVHK7zbizKboZT0B:P0vx4UKuDVHz4O2rK9OB2iYYKboy7
Score

10^/10

agenttesla collection credential_access discovery keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Drops file in Drivers directory
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslacollectioncredential_accessdiscoverykeyloggerpersistencespywarestealertrojan

behavioral2

agentteslacollectioncredential_accessdiscoverykeyloggerpersistencespywarestealertrojan

© 2018-2025

Terms | Privacy