Extracted

• • Target

    #4WIa5.exe

  • Size

    1.1MB

  • MD5

    8c9cf2d7436c524449d3559a379a9b7d

  • SHA1

    519ff74cb97229a1b1fd7c5515b165cf30472e28

  • SHA256

    1e71e56913f6531c96445bc90b51d49e9a69574236d97b3c36ce99db4f9a9ee7

  • SHA512

    bc6ba9da565af95854e77e1ed10019f29c50f35ba438b0dfa4fc073f9cb1f5e80f6522cce11e8cf25c368e6ffed3173a531d1683d8d87278782ff2f8b8c351ef

  • SSDEEP

    24576:9g7yqlK/1FuZ7zNrQ5DQRQFs0TZ7yw+mD:u7yLDkVrQ5ysTB9JD

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2