agenttesla | 94f34c7fa30595f792252d0b9cc5af5c3de392c36cccf236214512d11e425d36 | Triage

Submit
Reports

Overview

overview

Static

static

3

94f34c7fa3...36.exe

windows7-x64

94f34c7fa3...36.exe

windows10-2004-x64

Sharing

General

Target

94f34c7fa30595f792252d0b9cc5af5c3de392c36cccf236214512d11e425d36
Size

1.4MB
Sample

250114-b21rzssrbt
MD5

1c6acfc6630b36cc2ad1a06cda6e2a1d
SHA1

dd0d47d52e34c61a4764a461979297e544165245
SHA256

94f34c7fa30595f792252d0b9cc5af5c3de392c36cccf236214512d11e425d36
SHA512

f5189f84756885d1a0639a3606e0f96d5db65795234b438e2e6f7c2535ce88ea3db3d0c223c35cca47a9332b833c31cd5f37192da6354c9bdb89673751e41ce7
SSDEEP

24576:c4UT2DbWeHfyPaMiuv1RIAhjLoamMiX4lNmZg0YxegPbUIDPP:6T761M3jLoyEkmZ9Y14

Score

10^/10

agenttesla discovery keylogger persistence spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

94f34c7fa30595f792252d0b9cc5af5c3de392c36cccf236214512d11e425d36.exe

Resource

win7-20240708-en

agenttesla discovery keylogger persistence spyware stealer trojan

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

94f34c7fa30595f792252d0b9cc5af5c3de392c36cccf236214512d11e425d36.exe

Resource

win10v2004-20241007-en

agenttesla discovery keylogger persistence spyware stealer trojan

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.kugel-medical.com
Port:
587
Username:
[email protected]
Password:
stanstan12345

Targets

- Target
  
  94f34c7fa30595f792252d0b9cc5af5c3de392c36cccf236214512d11e425d36
- Size
  
  1.4MB
- MD5
  
  1c6acfc6630b36cc2ad1a06cda6e2a1d
- SHA1
  
  dd0d47d52e34c61a4764a461979297e544165245
- SHA256
  
  94f34c7fa30595f792252d0b9cc5af5c3de392c36cccf236214512d11e425d36
- SHA512
  
  f5189f84756885d1a0639a3606e0f96d5db65795234b438e2e6f7c2535ce88ea3db3d0c223c35cca47a9332b833c31cd5f37192da6354c9bdb89673751e41ce7
- SSDEEP
  
  24576:c4UT2DbWeHfyPaMiuv1RIAhjLoamMiX4lNmZg0YxegPbUIDPP:6T761M3jLoyEkmZ9Y14
Score

10^/10

agenttesla discovery keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- AgentTesla payload
- Drops file in Drivers directory
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agenttesladiscoverykeyloggerpersistencespywarestealertrojan

behavioral2

agenttesladiscoverykeyloggerpersistencespywarestealertrojan

© 2018-2025

Terms | Privacy