agenttesla | 635e20a681b1d8e8a4318e345cff50dc04cbd032a7414640137cbf5fa1c09a84 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

Shipping D...51.exe

windows7-x64

3

Shipping D...51.exe

windows10-2004-x64

Sharing

General

Target

Shipping Docs Waybill No 2009 xxxx 351.exe
Size

1.1MB
Sample

250113-h3slbsvkel
MD5

354725d3df06a1f01c0fe40b5613f21f
SHA1

28a300ab00a8e2d8b218adc084a2b946309d4fb7
SHA256

635e20a681b1d8e8a4318e345cff50dc04cbd032a7414640137cbf5fa1c09a84
SHA512

9c8b7807ce0531a688c26426b90352a6d21f9cfe7df480d484bea46d451ba5e6f6a56570a86a6be6673a6e38013ddb46bfbdfa9115c216c7807c6fec5218b78e
SSDEEP

24576:yr/LaBQDJDFlGOhvP7iUOpqYqjpYlA7dfUWTpSuaWV0cMc92:yvvDrGkvP7iUw98p57dflbaWOcMC2

Score

10^/10

agenttesla discovery keylogger persistence spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

Shipping Docs Waybill No 2009 xxxx 351.exe

Resource

win7-20241010-en

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

Shipping Docs Waybill No 2009 xxxx 351.exe

Resource

win10v2004-20241007-en

agenttesla discovery keylogger persistence spyware stealer trojan

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://s4.serv00.com
Port:
21
Username:
f2241_evica
Password:
Doll650@@

Targets

- Target
  
  Shipping Docs Waybill No 2009 xxxx 351.exe
- Size
  
  1.1MB
- MD5
  
  354725d3df06a1f01c0fe40b5613f21f
- SHA1
  
  28a300ab00a8e2d8b218adc084a2b946309d4fb7
- SHA256
  
  635e20a681b1d8e8a4318e345cff50dc04cbd032a7414640137cbf5fa1c09a84
- SHA512
  
  9c8b7807ce0531a688c26426b90352a6d21f9cfe7df480d484bea46d451ba5e6f6a56570a86a6be6673a6e38013ddb46bfbdfa9115c216c7807c6fec5218b78e
- SSDEEP
  
  24576:yr/LaBQDJDFlGOhvP7iUOpqYqjpYlA7dfUWTpSuaWV0cMc92:yvvDrGkvP7iUw98p57dflbaWOcMC2
Score

10^/10

discovery agenttesla keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

agenttesladiscoverykeyloggerpersistencespywarestealertrojan

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.