Extracted

• • Target
    PRE ALERT DOCUMENTS.exe
  • Size 690KB
  • SHA256 470c3ac6350508f77bd2b62e7a41af2dfc518b184f4bc22367f84c3a56987ed6
  • MD5 75df1ac2b8847c5267cd2ce01e880e2a
  • SHA1 e4f67256bf0e2398bbb6b19b52ee59bf7871b9ec
  • SHA512 913139ff85e23f9e340f10551c8888a4095274aca1adbdb3071ffa7f27abf0bf0cae03a59ada0e884fecb66912bb757d12347c2d7a01cb12f37baa210df7721e
  • SSDEEP 6144:j4Mq6jVKnWN/62dStLkVDreMOZv1amny5ecOKv9uXzyMqWy1ZQQq2pkare:MMq6hKW5XdSlWHqbyi+cLTWk1
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2