Extracted

• • Target
    TM00023211.exe
  • Size 25KB
  • SHA256 7ffa5fb65cb420698a4d9f54c52bc97d5bd4ac30813c727381d3bec8d3a0e192
  • MD5 15d3eb3f38d8451339b03ec1a9f64d5c
  • SHA1 7b8116791803f75e07f01cd910f66e5304d37088
  • SHA512 157daf761585d8dbc538303f83a5623a1fb4c778089143484c22687fa90375fc65b5deb0eba77059ee2b9489e97b328f96afe1d87388a071d33dafc31d8e077a
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealersuricatatrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • suricata: ET MALWARE AgentTesla Communicating with CnC Server

    suricata: ET MALWARE AgentTesla Communicating with CnC Server

    suricata

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2