Extracted

Extracted

• • Target

    BL & Original Shipping Documents AWB-62987268.exe

  • Size

    731KB

  • MD5

    7236e60628c25d1b48ae9de6eb5e6b8c

  • SHA1

    486cab73374fc98b369a1caf19bc2fc7c9285ad1

  • SHA256

    8ac57ec0d32b453aa23a1c7149d5cd5695c8a99a9bd0b792bfc1411b1216c4da

  • SHA512

    32e489c7ad82171d9349d7a89191d222aa3f784e462589345f3d1a010e63c024cd08232844d529d3396b60c505b3ef35f9378cea2c6efdd094e4b94c58d72873

  Score

  10^/10

  agentteslacollectionevasionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Disables RegEdit via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2