Extracted

• • Target
    6f7107586036a610eac9ff01f3bd85c6.exe
  • Size 513KB
  • SHA256 51c618c3e7e2fee52da462177f0dd44e5fbb3d6234edd8fbf5542c2dc51a8aee
  • MD5 6f7107586036a610eac9ff01f3bd85c6
  • SHA1 af3f1543c31852ccc7aba6c425670a660aa23658
  • SHA512 40f502c4684dfc7b8464c5b5f6035b8d93a9d0976fe46e91cc42fecc9dda844c49351e7e9864148c137bb4f61909caeacbbc46da85a42677d0c9162e715d0cc7
  • SSDEEP 12288:oNSAlgqypGV/+jxoh3iaHPe/MX1dPhaWXSUCAq:oNnlgqy0V/+jxohSic6d/Dlq
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2