Extracted

Extracted

• • Target

    documents.exe

  • Size

    791KB

  • MD5

    425d7d79e7b8a6b79890453f242f830b

  • SHA1

    b1dbeb640fd5853906014f923bd10ab82832c717

  • SHA256

    6a0cdf63baad32236d845d0027822d4e9c67ac4f9bddd9933ada09f9811dbca5

  • SHA512

    51c93e7b771c09f9a1bdaaf0191598eb5a95b6cac49e2bd2ab34d613e6607dc8a6d85537494d382c85d16778298e3f25d60652542795f9158e506a4519e1ba05

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealersuricatatrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • suricata: ET MALWARE AgentTesla Exfil Via SMTP

    suricata: ET MALWARE AgentTesla Exfil Via SMTP

    suricata

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2