agenttesla | 4f59cb11327f3bc771404ec413cddb131a0088b07eb73aba59c8ce429c48d408 | Triage

Submit
Reports

Overview

overview

Static

static

3

New order ...BB.exe

windows7-x64

7

New order ...BB.exe

windows10-2004-x64

Sharing

General

Target

New order 52825-01BB.7z
Size

1.1MB
Sample

250328-qlhc2aykv7
MD5

6c6dcaa0e786c9e75d5aabf3662b2cbe
SHA1

408e9286a5917f7c2eb4fc2b24b8a7909750e270
SHA256

4f59cb11327f3bc771404ec413cddb131a0088b07eb73aba59c8ce429c48d408
SHA512

fa3d8eb6926474cd23e77a565ace8de8324cc0445fcce9d5b5c6ec03c6cb1f2866da5bb7b927f4160cdf5bdcd9aafea1e79ac40b28febc3f46daab53165e8244
SSDEEP

24576:8bWeZWIslaL3tl7BNPM169zo9NiWxkanZdd3uTLrLnElmGb:8bWMWIRVRM1x9JBuT/7mV

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

New order 52825-01BB.exe

Resource

win7-20240903-en

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

New order 52825-01BB.exe

Resource

win10v2004-20250314-en

agenttesla discovery keylogger spyware stealer trojan

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.iaa-airferight.com
Port:
587
Username:
web@iaa-airferight.com
Password:
webmaster
Email To:
mail@iaa-airferight.com

Targets

- Target
  
  New order 52825-01BB.exe
- Size
  
  1.3MB
- MD5
  
  39e704ee8928b91f90a7345ca1943cbe
- SHA1
  
  ee19ad702a94204c35ad97f03a3a458689eed520
- SHA256
  
  db9075f1eadd4b7dfbc145d16f17c50ec345e99d3b5e3b7593f86e5b8532b4c5
- SHA512
  
  36b778adfe1620dc87f05e0612303991df3e7b2687f20c089a460cdaa961ef1f5deece095e904dd635ba99522e3cf764a45e9e883af1fa50db1f76582f406369
- SSDEEP
  
  24576:TP7cp85auu/geyQnsGHg1CwPOf2mYqbohHozrUqBT:Lt5af8QsGjfvYys4T
Score

10^/10

discovery agenttesla keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops startup file
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

agenttesladiscoverykeyloggerspywarestealertrojan

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.