agenttesla | a698a95da36f7ff9d72178542d0f40751d5a8791645784f8104c3228e3b87c48 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

a698a95da3...48.exe

windows7-x64

a698a95da3...48.exe

windows10-2004-x64

Sharing

General

Target

a698a95da36f7ff9d72178542d0f40751d5a8791645784f8104c3228e3b87c48.exe
Size

506KB
Sample

241124-fg8z3svmcz
MD5

22e8f94059d3383d524fe1a1d4f2eb2f
SHA1

1f3bc2add3763c59df4dc32c91a45698bcdc8030
SHA256

a698a95da36f7ff9d72178542d0f40751d5a8791645784f8104c3228e3b87c48
SHA512

a5f7bf6fa4323a9924aeb83d222269ecfde1e527c0447edef36f4dd4024663b80179ca030a60b81d84aa68d5d4dd875d86b8601c416c53b0c9cbb55d3bd1486a
SSDEEP

6144:Nw/nOK6Uqd2GhNXxfdjn/EGTZvrdyyy3UCANbZqDyFZOva5pFvuA+eWsqr+rXUSS:Nv3Ui2iNhJDNjdFyEJRZzFZL5fzFjmzN

Score

10^/10

agenttesla discovery keylogger persistence spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

a698a95da36f7ff9d72178542d0f40751d5a8791645784f8104c3228e3b87c48.exe

Resource

win7-20241010-en

agenttesla discovery keylogger persistence spyware stealer trojan

windows7-x64

9 signatures

120 seconds

Behavioral task

behavioral2

Sample

a698a95da36f7ff9d72178542d0f40751d5a8791645784f8104c3228e3b87c48.exe

Resource

win10v2004-20241007-en

agenttesla discovery keylogger persistence spyware stealer trojan

windows10-2004-x64

9 signatures

120 seconds

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
zxcvbnm12345

Targets

- Target
  
  a698a95da36f7ff9d72178542d0f40751d5a8791645784f8104c3228e3b87c48.exe
- Size
  
  506KB
- MD5
  
  22e8f94059d3383d524fe1a1d4f2eb2f
- SHA1
  
  1f3bc2add3763c59df4dc32c91a45698bcdc8030
- SHA256
  
  a698a95da36f7ff9d72178542d0f40751d5a8791645784f8104c3228e3b87c48
- SHA512
  
  a5f7bf6fa4323a9924aeb83d222269ecfde1e527c0447edef36f4dd4024663b80179ca030a60b81d84aa68d5d4dd875d86b8601c416c53b0c9cbb55d3bd1486a
- SSDEEP
  
  6144:Nw/nOK6Uqd2GhNXxfdjn/EGTZvrdyyy3UCANbZqDyFZOva5pFvuA+eWsqr+rXUSS:Nv3Ui2iNhJDNjdFyEJRZzFZL5fzFjmzN
Score

10^/10

agenttesla discovery keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- AgentTesla payload
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agenttesladiscoverykeyloggerpersistencespywarestealertrojan

behavioral2

agenttesladiscoverykeyloggerpersistencespywarestealertrojan

© 2018-2025

Terms | Privacy