Extracted

• • Target
    MM205LTVMNORIN000837.exe
  • Size 643KB
  • SHA256 ec8b1456e2458e604e3fa2815364664889a01ff1e330c360572be069aa1cf9f0
  • MD5 8565a3150ce89567fb4ef599f9c613f2
  • SHA1 2c475d9207ff435ada83fa69ac7825f54d5673b9
  • SHA512 1769f942a3e39aac887a0d5dd86976ca111c1c38fb2d5f0b50547ac92554168397b62e96836de1464b28db3db68218465b7a86d340a0a1dafe45adc1e2940f09
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslaagilenetkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2