Extracted

Extracted

• • Target
    SecuriteInfo.com.W32.AIDetectNet.01.9904.14910
  • Size 793KB
  • SHA256 a99abe3b5f6f7c42d24d00d149a859df076b9cb8f7b91bd4a0c04cf8a404cc50
  • MD5 a5df961d33043779bfbe15d9d00e65bc
  • SHA1 2f54dc5953b0f7339c300e89b2a0bbd63de213d9
  • SHA512 e6bd9d9da5c768de8a0d7289621b02d185bf1edb4652173e1f1a34a4c1cc7e3567da366808a1884c994f28b9aa17e620e85ef8857717501a53c897b0c0e22717
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealersuricatatrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • suricata: ET MALWARE AgentTesla Exfil Via SMTP

    suricata: ET MALWARE AgentTesla Exfil Via SMTP

    suricata

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2