Extracted

• • Target
    SecuriteInfo.com.Variant.MSILHeracles.43220.3403.23809.exe
  • Size 19KB
  • SHA256 ee521d7554ad7fba79ca211b807366a879fbf25bc57de72d76f0e366a81503fb
  • MD5 d993f8c3ef61cc15b3f5517bc21c0c44
  • SHA1 dc672c24e92b4f60eb09f9d8f2fab809391bbc28
  • SHA512 60aeaba346fcd8146effcac2fb5a487bff47c08cb2906ca8fc04ef7bae84f1aa0a0be695c5f9b22585bc85a55a6a0ec9ba84c719c01b6ee339e7821a589f0511
  • SSDEEP 384:3TJqOJZSRimRUB0RRWfre6qlEEg93kh/n:3jCRimR52S60Epqv
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2