agenttesla | cb9ee01af339913452877ef2e8b5740836c7b56e3807ecea1b0ccacb61e7fbd5 | Triage

Submit
Reports

Overview

overview

Static

static

5

cb9ee01af3...d5.exe

windows7-x64

cb9ee01af3...d5.exe

windows10-2004-x64

Sharing

General

Target

cb9ee01af339913452877ef2e8b5740836c7b56e3807ecea1b0ccacb61e7fbd5
Size

1.2MB
Sample

241016-zpyc4awbnr
MD5

a3edde17d6cc8f601236f34949de23f0
SHA1

c5e13b3991a5aa8ef52e3ca586dd5c001ebd5b8c
SHA256

cb9ee01af339913452877ef2e8b5740836c7b56e3807ecea1b0ccacb61e7fbd5
SHA512

e3d09b87a9bccff037d1af5ac550712c44a344f92c1b127eae95c03748cda35ab7fa931f158323b2dc0ac8b14a8e4097b8e864dbdd3f8129131d7dd24d535c01
SSDEEP

24576:xAHnh+eWsN3skA4RV1Hom2KXMmHag3PDQBQSKbbTgzMGgA5:Ih+ZkldoPK8Yag/yQfgzMGT

Score

10^/10

agenttesla discovery keylogger persistence spyware stealer trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

cb9ee01af339913452877ef2e8b5740836c7b56e3807ecea1b0ccacb61e7fbd5.exe

Resource

win7-20241010-en

agenttesla discovery keylogger persistence spyware stealer trojan

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

cb9ee01af339913452877ef2e8b5740836c7b56e3807ecea1b0ccacb61e7fbd5.exe

Resource

win10v2004-20241007-en

agenttesla discovery keylogger persistence spyware stealer trojan

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  cb9ee01af339913452877ef2e8b5740836c7b56e3807ecea1b0ccacb61e7fbd5
- Size
  
  1.2MB
- MD5
  
  a3edde17d6cc8f601236f34949de23f0
- SHA1
  
  c5e13b3991a5aa8ef52e3ca586dd5c001ebd5b8c
- SHA256
  
  cb9ee01af339913452877ef2e8b5740836c7b56e3807ecea1b0ccacb61e7fbd5
- SHA512
  
  e3d09b87a9bccff037d1af5ac550712c44a344f92c1b127eae95c03748cda35ab7fa931f158323b2dc0ac8b14a8e4097b8e864dbdd3f8129131d7dd24d535c01
- SSDEEP
  
  24576:xAHnh+eWsN3skA4RV1Hom2KXMmHag3PDQBQSKbbTgzMGgA5:Ih+ZkldoPK8Yag/yQfgzMGT
Score

10^/10

agenttesla discovery keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agenttesladiscoverykeyloggerpersistencespywarestealertrojan

behavioral2

agenttesladiscoverykeyloggerpersistencespywarestealertrojan

© 2018-2025

Terms | Privacy