Extracted

• • Target

    06121599.exe

  • Size

    723KB

  • MD5

    278d48d9ea2fe8350796279e5d08a72a

  • SHA1

    30a693e39b775de6afbd146722d07bba0e4f16bf

  • SHA256

    53823b0378b9a17181fef455b3625e7909e703d600b480ffccc9a1c6d4232c4a

  • SHA512

    2522bbd936bce6a0849892fe5c49850c74c0becea7567d21e27c0b8a314c29e44bbcb20b5d6e6ad8b44d0009a4304a4c64a8c935bd2284bd98931faba93b324d

  • SSDEEP

    12288:1KK7z5GoJiGaq5aub+2QsKn/KOOfyXuKMu+h3pLGU+arbVifvHehJes:z5GoR5aa+jHOA4h/+cVifvH8

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2