Extracted

• • Target

    06430699.rtf

  • Size

    24KB

  • MD5

    52a40a96fd119c25e2e6c945c2dd64b2

  • SHA1

    b060ca795a632131b388d307ab742d1154137765

  • SHA256

    0523c012c8d1bdeba2cdefa7ad400cbd029222e79700cf66314c0fb76057420e

  • SHA512

    fdf0800c565080b98196756c9a271d35f2bd6adaba391a8f9f8be7fa63c66da06a1b07e793ec68f2e8a2aa00158e1c690d3a73b6d99338fb1741ec2cbbced3fc

  • SSDEEP

    768:g9pz5jJQ+wvWpU7sMd7dtHm7gvM4q8YwgtgUFs:g9pz5++w+pU7ndZtHmMEr8Zgo

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2