agenttesla | 531821260f1bee4ade4c1cef58d0336b5c14f7676db80c62dedf666df2aae2e4 | Triage

Sharing

General

Target

531821260f1bee4ade4c1cef58d0336b5c14f7676db80c62dedf666df2aae2e4.exe
Size

1.0MB
Sample

241008-rey8mszgqp
MD5

1197c2599d56418fd62e2615e9e01446
SHA1

9aff357f6d489f7f971de35a45c81b23f3302697
SHA256

531821260f1bee4ade4c1cef58d0336b5c14f7676db80c62dedf666df2aae2e4
SHA512

d2be846facfdf90174c4aeaf49319ca6161a9e46a987f84fda9b99ae97147bb162b4477eb65505dd2539e0741fac86e880be3a4c8c8ad7294f377199e0ac15c4
SSDEEP

24576:nwQ6DZ+1E9IZWQJSoFSoJlNjEWYPtQSWmucE712nj8nEks:nwQb+W1JPZJlNjnwTY7gj8ns

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot7103128534:AAEX7cqstzGDmw81dLz-shfxzvXALbiavNI/

Targets

- Target
  
  531821260f1bee4ade4c1cef58d0336b5c14f7676db80c62dedf666df2aae2e4.exe
- Size
  
  1.0MB
- MD5
  
  1197c2599d56418fd62e2615e9e01446
- SHA1
  
  9aff357f6d489f7f971de35a45c81b23f3302697
- SHA256
  
  531821260f1bee4ade4c1cef58d0336b5c14f7676db80c62dedf666df2aae2e4
- SHA512
  
  d2be846facfdf90174c4aeaf49319ca6161a9e46a987f84fda9b99ae97147bb162b4477eb65505dd2539e0741fac86e880be3a4c8c8ad7294f377199e0ac15c4
- SSDEEP
  
  24576:nwQ6DZ+1E9IZWQJSoFSoJlNjEWYPtQSWmucE712nj8nEks:nwQb+W1JPZJlNjnwTY7gj8ns
Score

10^/10

agenttesla discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agenttesladiscoverykeyloggerspywarestealertrojan

behavioral2

agenttesladiscoverykeyloggerspywarestealertrojan