Extracted

• • Target
    SecuriteInfo.com.MSIL.Agent.NHM.tr.dldr.14525.exe
  • Size 922KB
  • SHA256 88b00afd2b4f33893e8ca2dfb3a40cfa15d990d731cb1b15617a8f606b5672d0
  • MD5 afc3fda333d36c2265c138264b171d21
  • SHA1 bbf3fbb8f9e33027f9756a9f9c235c6841710e65
  • SHA512 df1069897926ec6e5cd61a87dba3958a631739c5b23dc5f620b795680db5593f716230c032aec95fe855479307414c24e8de3c5ef5dea2fc7a377d4d9d0e18ab
  • SSDEEP 24576:/JplXmT7dgwyN9s+/lYrTVNO1Hepvb4x:/JplXmTBM9s+9GaHO
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojancollection

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2