Extracted

Extracted

• • Target
    SecuriteInfo.com.IL.Trojan.MSILMamut.5433.18030.19973
  • Size 584KB
  • SHA256 a34f20e924863e763dcbede1b80622d8ee3ff3d0190b3b0e3989f7d96e68bf5e
  • MD5 94d6a9c4cd2ca7675d01a59658a2146b
  • SHA1 8c0092c7b9ab182ed270ea42e65557be3202c0ed
  • SHA512 236418c5d0774b1dd6a1bbe3eb6f3fc484db29fd35260b8e518a00d043f6c4a4b7f728f1a6ba324d39436fbe9759d0adc141c5a315687b82a2e1ba12caccf18c
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2