Extracted

• • Target
    Outstanding_payment202047654Outstanding_payment202047654.exe
  • Size 877KB
  • SHA256 4fa6b42e185b020148be0e775cdca44f00701b7cd2e68d78dc16cf6dcf6a2dba
  • MD5 4f1c612c8c1853738f853e8085e68c89
  • SHA1 fe0b9af726210861fdb92f1b4639bc842f62d4f0
  • SHA512 b31964e91b5688d661fb2664cb994da8534b6ac08215331a45db0c2e180abdc2752751f250502bcefefa9a84ead478ac1f9528b116fc3a871ceabe4e696a2cec
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2