Extracted

• • Target
    SecuriteInfo.com.W32.AIDetectNet.01.24324.11298
  • Size 25KB
  • SHA256 1d19970cc9dbb2fbab3acafb0fb2d5988be9be0f10e975960668b44f34cbe152
  • MD5 8ad099d2e4ec49feb72befc5243d57ff
  • SHA1 fb5c5712cb137beeff81f5eb8003b524d670a770
  • SHA512 b6e232a8aa679682cb60c2ba407eea97e77d273089ac3ef3496cce0d14ee82616406a4375e54808e5d7eded456d8a6b414d3f204708c64f0e16855e0582a8ec7
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojancollection

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2