Extracted

• • Target

    5c571a20aef5d31ad3edbfd65e33540201dde1f9ccf5eaae84332f1bf1e09ea2.exe

  • Size

    890KB

  • MD5

    852b20b7affadeb7d7d6b4a88c2355b5

  • SHA1

    a8ec160119ea5c5a2f6b79de1d611a5c45f4d248

  • SHA256

    5c571a20aef5d31ad3edbfd65e33540201dde1f9ccf5eaae84332f1bf1e09ea2

  • SHA512

    eb72ac6932f74b0843dbcf9401e2efafd265154e7bc47b49a4e34dc2025c066ba29d0c17d7fdec79c80d717f52e7c1d6646f0e4452b6861a4adee0952baf58e8

  • SSDEEP

    12288:RoQgKZ/nXt7virmWhlGLaQYIYvFW67gl89/r2AXyRh+DITnAIuJS6RXpRALqUpjl:qu8RKh+DyAI6pCLD

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojancollection

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2