agenttesla | 6484a1beb77fa93cf21adbf91ba4c0c60985c2dab4be45370c7d8f48eedf0a7d | Triage

Submit
Reports

Overview

overview

Static

static

3

6484a1beb7...cs.exe

windows7-x64

6484a1beb7...cs.exe

windows10-2004-x64

7

Sharing

General

Target

6484a1beb77fa93cf21adbf91ba4c0c60985c2dab4be45370c7d8f48eedf0a7d_NeikiAnalytics.exe
Size

989KB
Sample

240629-fasdrathll
MD5

991ca34ddd5dd8615fe906a88d80fb30
SHA1

9c870be932ba1396d3e33df1e6e455a20ddd99b2
SHA256

6484a1beb77fa93cf21adbf91ba4c0c60985c2dab4be45370c7d8f48eedf0a7d
SHA512

433f506691da6f04928351287c8cd5bcf658f14513779c949ec66e500b8a68f340e01feb82beefcdb21a30496eaef19d3f8fd94e217cac0bbadc3f1411cc72f4
SSDEEP

12288:iDDjV0vdloI9mDZ1vDFki1WT08fcUkuoRm/SIo6I6JT/sRfpdC6M:KjWvsIMZ1hkSuoYaY/sRfXC6M

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

6484a1beb77fa93cf21adbf91ba4c0c60985c2dab4be45370c7d8f48eedf0a7d_NeikiAnalytics.exe

Resource

win7-20240508-en

agenttesla keylogger persistence spyware stealer trojan

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

6484a1beb77fa93cf21adbf91ba4c0c60985c2dab4be45370c7d8f48eedf0a7d_NeikiAnalytics.exe

Resource

win10v2004-20240508-en

windows10-2004-x64

6 signatures

150 seconds

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.zoho.eu
Port:
587
Username:
[email protected]
Password:
office12#
Email To:
[email protected]

Targets

- Target
  
  6484a1beb77fa93cf21adbf91ba4c0c60985c2dab4be45370c7d8f48eedf0a7d_NeikiAnalytics.exe
- Size
  
  989KB
- MD5
  
  991ca34ddd5dd8615fe906a88d80fb30
- SHA1
  
  9c870be932ba1396d3e33df1e6e455a20ddd99b2
- SHA256
  
  6484a1beb77fa93cf21adbf91ba4c0c60985c2dab4be45370c7d8f48eedf0a7d
- SHA512
  
  433f506691da6f04928351287c8cd5bcf658f14513779c949ec66e500b8a68f340e01feb82beefcdb21a30496eaef19d3f8fd94e217cac0bbadc3f1411cc72f4
- SSDEEP
  
  12288:iDDjV0vdloI9mDZ1vDFki1WT08fcUkuoRm/SIo6I6JT/sRfpdC6M:KjWvsIMZ1hkSuoYaY/sRfXC6M
Score

10^/10

agenttesla keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

agentteslakeyloggerpersistencespywarestealertrojan

behavioral2

© 2018-2024

Terms | Privacy