Extracted

• • Target
    Dispatch Note - 6183111.exe
  • Size 503KB
  • SHA256 39dc873bb74e369b04ba0b7c06fae772f38b68f7f7faf5cd80fed361664cc2c7
  • MD5 79e10fe02b8c4bdf8ff99b3d41dd297c
  • SHA1 76c663b33d0f6a7f01e6c1cdc4711d25a8c42d3e
  • SHA512 7318b8c605d143fe8a65cd9e6328de50464c2562e4956bba3956aff06a6761e93ad1aacbbb00a9521cab878effcd781b60bf76aa2a28549fad5a855a89953dff
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2