agenttesla | e3ab7e992cbca9f4b093e4ddeb060ea08889246d1a0a4f233e77c1e8863d8995 | Triage

Submit
Reports

Overview

overview

Static

static

3

e3ab7e992c...95.exe

windows7-x64

e3ab7e992c...95.exe

windows10-2004-x64

Sharing

General

Target

e3ab7e992cbca9f4b093e4ddeb060ea08889246d1a0a4f233e77c1e8863d8995.exe
Size

520KB
Sample

241123-e5tdvsvkej
MD5

b404e9bb4b3b27ce619c959850e2eefc
SHA1

e5ea0bd77376e24acc7cbda183b0942cb8b02a10
SHA256

e3ab7e992cbca9f4b093e4ddeb060ea08889246d1a0a4f233e77c1e8863d8995
SHA512

dbb5dfcefa98f75d9de0609faa9d980c48bc063cafe3ef8aa8911731cb72bd44015ebbc8453f3800a2c0c9d2f9acadb0e8cfe75a9b9c10c2ae38f380d7770f15
SSDEEP

12288:UcMhUi2iNbL+UC5n8DreYwiAecqVokngGV:UcMhUi1l05n8mcHc7kH

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

e3ab7e992cbca9f4b093e4ddeb060ea08889246d1a0a4f233e77c1e8863d8995.exe

Resource

win7-20240903-en

agenttesla discovery keylogger spyware stealer trojan

windows7-x64

9 signatures

120 seconds

Behavioral task

behavioral2

Sample

e3ab7e992cbca9f4b093e4ddeb060ea08889246d1a0a4f233e77c1e8863d8995.exe

Resource

win10v2004-20241007-en

agenttesla discovery keylogger spyware stealer trojan

windows10-2004-x64

9 signatures

120 seconds

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.scahe.co.in
Port:
587
Username:
[email protected]
Password:
scaheavy@12345

Targets

- Target
  
  e3ab7e992cbca9f4b093e4ddeb060ea08889246d1a0a4f233e77c1e8863d8995.exe
- Size
  
  520KB
- MD5
  
  b404e9bb4b3b27ce619c959850e2eefc
- SHA1
  
  e5ea0bd77376e24acc7cbda183b0942cb8b02a10
- SHA256
  
  e3ab7e992cbca9f4b093e4ddeb060ea08889246d1a0a4f233e77c1e8863d8995
- SHA512
  
  dbb5dfcefa98f75d9de0609faa9d980c48bc063cafe3ef8aa8911731cb72bd44015ebbc8453f3800a2c0c9d2f9acadb0e8cfe75a9b9c10c2ae38f380d7770f15
- SSDEEP
  
  12288:UcMhUi2iNbL+UC5n8DreYwiAecqVokngGV:UcMhUi1l05n8mcHc7kH
Score

10^/10

agenttesla discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- AgentTesla payload
- Drops file in Drivers directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agenttesladiscoverykeyloggerspywarestealertrojan

behavioral2

agenttesladiscoverykeyloggerspywarestealertrojan

© 2018-2024

Terms | Privacy