Extracted

Extracted

• • Target
    2022-04-12.exe
  • Size 840KB
  • SHA256 6dafa379cab8cf6a545e3e018c8afa2dd888f7e168bacf2a24de7ae8644aeef5
  • MD5 b4dfeb164489d6dd7a8338d1dd08bcf5
  • SHA1 59e076b00876998453bc31b87c6e0cf4547d4957
  • SHA512 282882d09ff7c47ee505a88fd803c792066410f72fc1d484b10d13cd584e81ac31a72196ff33c9bcfd92e51c10d587787474c3051ff75cc4b94a21f93597584f
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealersuricatatrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • suricata: ET MALWARE AgentTesla Exfil Via SMTP

    suricata: ET MALWARE AgentTesla Exfil Via SMTP

    suricata

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2