agenttesla | 2b44c9721b8bb2b4ff211c079e010a9e6c0f612a62e6f6e6aa6437068f00a46f | Triage

Submit
Reports

Overview

overview

Static

static

5

DGT7827209...27.exe

windows7-x64

1

DGT7827209...27.exe

windows10-2004-x64

Sharing

General

Target

DGT7827209926Y8-HKL8292872-XGC76SD7827.exe
Size

1.1MB
Sample

240701-p2yjhssekb
MD5

7d46fab950aba821fb72c0cfa8b9020c
SHA1

10e41f1edc2ee71a25e03d16efcd7daad3d4f702
SHA256

2b44c9721b8bb2b4ff211c079e010a9e6c0f612a62e6f6e6aa6437068f00a46f
SHA512

4c51e5f35049380bc2daa41b2b90bbed4ee5284021c8b49d260d01669e02c4ed782c70cfdb2adb9d586b4536a732ebae4cc0c86056f0fc64ae11380b9a31d7aa
SSDEEP

24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaauLAWbV5KzSE8m5:gh+ZkldoPK8YaauxjKzNd

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

DGT7827209926Y8-HKL8292872-XGC76SD7827.exe

Resource

win7-20240220-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral2

Sample

DGT7827209926Y8-HKL8292872-XGC76SD7827.exe

Resource

win10v2004-20240611-en

agenttesla collection keylogger spyware stealer trojan

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.agaliofu.top
Port:
587
Username:
[email protected]
Password:
QPS.6YYl.Yi=
Email To:
[email protected]

Targets

- Target
  
  DGT7827209926Y8-HKL8292872-XGC76SD7827.exe
- Size
  
  1.1MB
- MD5
  
  7d46fab950aba821fb72c0cfa8b9020c
- SHA1
  
  10e41f1edc2ee71a25e03d16efcd7daad3d4f702
- SHA256
  
  2b44c9721b8bb2b4ff211c079e010a9e6c0f612a62e6f6e6aa6437068f00a46f
- SHA512
  
  4c51e5f35049380bc2daa41b2b90bbed4ee5284021c8b49d260d01669e02c4ed782c70cfdb2adb9d586b4536a732ebae4cc0c86056f0fc64ae11380b9a31d7aa
- SSDEEP
  
  24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaauLAWbV5KzSE8m5:gh+ZkldoPK8YaauxjKzNd
Score

10^/10

agenttesla collection keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

behavioral2

agentteslacollectionkeyloggerspywarestealertrojan

© 2018-2024

Terms | Privacy