Extracted

• • Target

    Ref. # IRQ-21-007783.exe

  • Size

    461KB

  • MD5

    c8e1f5d76a8f5131e5347c76e9ec2bdf

  • SHA1

    fcd565e0c15debaba5186e2832beff76b83b6301

  • SHA256

    29b1033a886b90d092ec14041729bca1d00a4da73457ad62bebd03251343fefb

  • SHA512

    7f8298c3e626a54470b4823b6898008b30d095e25be0d5a9530162a866ebe7ee696999e3a22d41d90271a0c20039d70e9c77623b0a72de640fc0b062d2edcf54

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2