Extracted

• • Target

    opy BL and Debit Note.exe

  • Size

    422KB

  • MD5

    ce00cefb977e8a50e8942a9ddb6eccee

  • SHA1

    646e7fca81c38570a9a98cf547c030c7590941b9

  • SHA256

    1be9f705235200cb51b70aadeb4252fae371b17c95d09b20ee79160833479ac2

  • SHA512

    e931a9c5e8510ff8fbd7fffec63df18a867fcdc44c374a1316757bada1f7dfcb0a943fa247347b7ddc2577eef1b41f42483367e6dea32b898a16a00a1c0ed7d3

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2