Extracted

Extracted

• • Target
    blessed.exe
  • Size 617KB
  • SHA256 683fcdb3fba783c37005aa82c2a83d694e21326d11c3c3ce2a4ee9815c23638b
  • MD5 4a4538eb78690334340b3763e5beecb4
  • SHA1 d07f83ca617760e4cc21ea5618672b182ea4e867
  • SHA512 98914badd2a8ba1c037a71a3ff79cc340aaf857f464be773d5e19a52076e3cbe55a514f09573eba1e20ff1fd81a9852f19fdd5b72cecd5c0deaa7729745ea2a1
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2