Extracted

• • Target
    Spec&drawing_New order06614820220124112125.exe
  • Size 529KB
  • SHA256 8d132f4101af84f515e1221778a172efae55dbb6efb6bbe1f61bab8f5b7e6ea8
  • MD5 7be2b8804393dab597f3f64c6c11284f
  • SHA1 3b76e8c9278d14d7d85e024d21a7674d214dcf2f
  • SHA512 9b10bb14d3e257b576f958ef171d733e987b8906fbb79d5e770d304867b6ed5177cb26ef8f373b38a39dc9cf49190a97f08e5695686a7fe4187c98f5fca35c05
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2