Extracted

• • Target

    LXBLR3L9.EXE

  • Size

    762KB

  • MD5

    4094cf514871980d06d87d794ba56bf2

  • SHA1

    93f17102519ad0fd4980132880a3226792223500

  • SHA256

    8c481355c79bca62d7c8096171c7b195d1c0d957cac8370a54ee74ff192fd2c9

  • SHA512

    d4f836c7f19d549b1578736baf53a527c0e6a12789c6fcbb4cd2bb8b463d4af723efc138a4c23c5ffd5cca9856136198d1e888fe012783648008eb481ee86868

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2