Extracted

Extracted

• • Target

    FACT.exe

  • Size

    1.2MB

  • MD5

    79af5265132dadfb51cad9e489c4cb2c

  • SHA1

    04407e9a07f6c551f396bb54b921607f57f53f3b

  • SHA256

    4636c1fc5d6c36ecc80466e93afb73704666834e481d0896801d0e401261a208

  • SHA512

    059ffc4e2976babe1acd7d2a2f10f98de89a5ec644965de5f94b9c222d2da51858aa72c88d51f2a9dd7e259e542c433765ed7d0c457003fa0acad05612694b85

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2