Extracted

Extracted

• • Target

    SecuriteInfo.com.MSIL.Kryptik.AGIJ.tr.19730.exe

  • Size

    1.1MB

  • MD5

    568bf07b9f60920d19a26bb5db7a8b8a

  • SHA1

    ae7e5bdefe29d99bac791e99e823ea7076ba1397

  • SHA256

    2a94cbccd066c93352211a7c6aa3de2870085450186fcba25bbfe951d3118d21

  • SHA512

    6816b0b6fe701f422cb64083e780b26b736bc65da8e99d983b143465b41f109ed5fed9dd9bb1050b357ce9a2129350b2a4fbedc809f4631ac8e79cec0555b5db

  • SSDEEP

    12288:GxEkTtIZyteN7tE2JKkysOSODElKbiFTgC3Adwy1lEvqT6AGp97JOJ4B3t:GJTt1YN5E2BODOKOFR3Owy1lFEVMA3

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2