Extracted

• • Target

    INVOICE.exe

  • Size

    530KB

  • MD5

    6426bbfce0fb5578344e80ea510bafb2

  • SHA1

    6cd2481ce9fcfc58c6fc5405a437f7f639034085

  • SHA256

    b72ebb6d27797219209ba8fdfbbe32447e34919e080af0a0fa31117921ad59b0

  • SHA512

    c70f04f64310f6d5f112a2a36266b69a50918f09f8b33c900b512a7268196fa898c1c1da44b7786cc623c0a2673eff8d2699c9280d3cabf1aea9d27cf1536e06

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2