agenttesla | b698411bdcbb7e6fe71cec5cdc499eda82a55495847221350d29a74ca7937186 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

b698411bdc...86.exe

windows7-x64

b698411bdc...86.exe

windows10-2004-x64

7

$PLUGINSDI...mq.dll

windows7-x64

$PLUGINSDI...mq.dll

windows10-2004-x64

3

Sharing

General

Target

b698411bdcbb7e6fe71cec5cdc499eda82a55495847221350d29a74ca7937186
Size

453KB
Sample

241125-bpx6bszqc1
MD5

2f3755d4f3c16b679640a95f756ab59a
SHA1

8dabe89c3f1e683a33caee3812a1fe15fd1b8c7d
SHA256

b698411bdcbb7e6fe71cec5cdc499eda82a55495847221350d29a74ca7937186
SHA512

cfcee82d4c5de54b511283e5da2ff530110134ec1907caec3f39f031185be9aa44b512da0e2e6a6816dbb3f85dc9f9f23e409d96fa70b5c49b97cbe9281e8d9c
SSDEEP

6144:pBlL/cC95z7t6MRObOjPnEezm7m6mBmtRm+mQsUKCI887/+JUrhoItI8SCjegF5w:PObbazoTFQ99qX9NZQZ3Tha

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

b698411bdcbb7e6fe71cec5cdc499eda82a55495847221350d29a74ca7937186.exe

Resource

win7-20240903-en

agenttesla discovery keylogger spyware stealer trojan

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

b698411bdcbb7e6fe71cec5cdc499eda82a55495847221350d29a74ca7937186.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral3

Sample

$PLUGINSDIR/cxapxirycmq.dll

Resource

win7-20240729-en

agenttesla discovery keylogger spyware stealer trojan

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral4

Sample

$PLUGINSDIR/cxapxirycmq.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

3 signatures

150 seconds

Malware Config

Targets

- Target
  
  b698411bdcbb7e6fe71cec5cdc499eda82a55495847221350d29a74ca7937186
- Size
  
  453KB
- MD5
  
  2f3755d4f3c16b679640a95f756ab59a
- SHA1
  
  8dabe89c3f1e683a33caee3812a1fe15fd1b8c7d
- SHA256
  
  b698411bdcbb7e6fe71cec5cdc499eda82a55495847221350d29a74ca7937186
- SHA512
  
  cfcee82d4c5de54b511283e5da2ff530110134ec1907caec3f39f031185be9aa44b512da0e2e6a6816dbb3f85dc9f9f23e409d96fa70b5c49b97cbe9281e8d9c
- SSDEEP
  
  6144:pBlL/cC95z7t6MRObOjPnEezm7m6mBmtRm+mQsUKCI887/+JUrhoItI8SCjegF5w:PObbazoTFQ99qX9NZQZ3Tha
Score

10^/10

agenttesla discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- AgentTesla payload
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/cxapxirycmq.dll
- Size
  
  20KB
- MD5
  
  f9c99f7e3b80bd0757ccad6a4ee2c795
- SHA1
  
  e487ee3c5fc3d1e0817a8c5646ed042312a8ad83
- SHA256
  
  963d2beb680b2f7b490063c3f248ae28fdadec39b0b9542c4b79a48f07bbd907
- SHA512
  
  c4ed2f2dc2b6d79f3f37433023428bfe7607360e257864e29fab249619e666df5b00542640d89f29ae510f83e514b41eba14fcc3232e9416a0b8e248eb59b01c
- SSDEEP
  
  384:7ANhp0pWEbbJVpptCxAoNI2M+qjMoejTJ1Yl5Zn:Ghp0cEbbJPp/NQoyJ1Y7Z
Score

10^/10

agenttesla discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- AgentTesla payload
- Suspicious use of SetThreadContext
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agenttesladiscoverykeyloggerspywarestealertrojan

behavioral2

behavioral3

agenttesladiscoverykeyloggerspywarestealertrojan

behavioral4

© 2018-2025

Terms | Privacy