Extracted

Extracted

• • Target
    k1d.exe
  • Size 938KB
  • SHA256 f8455e5d2f2ddddf2f3e2764602974a85d680d33e5dd13d636882a1e7523f254
  • MD5 8d8eee944f16d190c08d8d8db5fb5797
  • SHA1 fa887be7d404c65fdc4657aeda9844143a2e6514
  • SHA512 40b2ffcd4d23bb49a010ca4a807bd96ea118d79050e80c7a889ce2b19efe6678d815ec6015ce87485e81145e2e1d85ae9d359ff5dc4fb44557177d025c19437c
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2