agenttesla | 67362222dc4dae93f62f984771afb1b9d319ea23335bd4bb4e941f5e1248edc2 | Triage

Submit
Reports

Overview

overview

Static

static

5

EWW.exe

windows7-x64

EWW.exe

windows10-2004-x64

Resubmissions

16-02-2024 14:49

240216-r63p5scg33 10

16-02-2024 14:21

240216-rnzkrsbh8v 10

Sharing

General

Target

EWW.exe
Size

920KB
Sample

240216-rnzkrsbh8v
MD5

8077b3e5a20f5d489fa82982140733ab
SHA1

52a097dfa8e24b4ab52c9cae829df1b38ecc4e84
SHA256

67362222dc4dae93f62f984771afb1b9d319ea23335bd4bb4e941f5e1248edc2
SHA512

580c5888489d575fcc1e4e0a802ee125e9036761436ed1b58ae9e51e0e6bc5e025a892328cda12530b5343f8ace9bdba967bdeaca982190d3ad39fc0bad0d6e2
SSDEEP

24576:pRmJkcoQricOIQxiZY1iaM/U48ni1dq6ReVbi4:mJZoQrbTFZY1iaM/vuWdq6O

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

EWW.exe

Resource

win7-20231215-en

agenttesla collection keylogger spyware stealer trojan

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

EWW.exe

Resource

win10v2004-20231222-en

agenttesla collection keylogger spyware stealer trojan

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.awelleh3.top
Port:
587
Username:
[email protected]
Password:
54x%ex3wbV$1
Email To:
[email protected]

Targets

- Target
  
  EWW.exe
- Size
  
  920KB
- MD5
  
  8077b3e5a20f5d489fa82982140733ab
- SHA1
  
  52a097dfa8e24b4ab52c9cae829df1b38ecc4e84
- SHA256
  
  67362222dc4dae93f62f984771afb1b9d319ea23335bd4bb4e941f5e1248edc2
- SHA512
  
  580c5888489d575fcc1e4e0a802ee125e9036761436ed1b58ae9e51e0e6bc5e025a892328cda12530b5343f8ace9bdba967bdeaca982190d3ad39fc0bad0d6e2
- SSDEEP
  
  24576:pRmJkcoQricOIQxiZY1iaM/U48ni1dq6ReVbi4:mJZoQrbTFZY1iaM/vuWdq6O
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Email Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

agentteslacollectionkeyloggerspywarestealertrojan

behavioral2

agentteslacollectionkeyloggerspywarestealertrojan

© 2018-2024

Terms | Privacy