Extracted

Extracted

• • Target

    PO#908827 dated 9-7-2020 2019BT206-1+2020BT021+042.exe

  • Size

    586KB

  • MD5

    771d6920c81e63c41104ceb4b31b3d95

  • SHA1

    556f0940be0985b4f661d57fa894de06d945a53e

  • SHA256

    2f749c6cbdf1d58629bc39b28bb2b1f74766bfb982cc31e3461d1c4bcbd32b01

  • SHA512

    2ba7095fef121ed4d31e5bc5a171f09baa4b3c274e56428ec1b2c4e32ecc4a83315f13268f0e569d045a6c2fc189315b5897b2f703ecbb21ce8093dc0c5b1938

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2