Extracted

• • Target
    pre-alert KFL031321153729.exe
  • Size 439KB
  • SHA256 afee42ed642d4f824b52d9c32a0965c204f97edf9be9e5b4d6a8011db59e5525
  • MD5 66a7bec2bd9bbcac23793a6a59ef915c
  • SHA1 db8b5dc1b44503dcccfb203cea304e124754388b
  • SHA512 00fd284813ac4f157b973e698878688577fa74951b664ae612d88e8c287620cfdf7b6463fa69c782d64960ebbe6d829730dbb57e86076b81d30d556ec6befe28
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2