Extracted

• • Target

    Adjunto orden de 20El 17072023.exe

  • Size

    593KB

  • MD5

    2ea2de92d8d8acebb6efc0235e479bc0

  • SHA1

    5533708482177093b463d45be4e67f194ab9069b

  • SHA256

    8a9134daa25d861d333adfea78e7243d2668d86dd35c18ec05593b9ad8f2a219

  • SHA512

    ae789935d14e4e7b75334158f7fc88d88219ed2f5214d274eac25e30e1cd6688c34ecf3a2b632054f888c8544a0df80c990ac3164bcdbc01cb3234a378bed826

  • SSDEEP

    12288:Yfb/WT4UkuZbphndhZKDqpdNKl5KdZQQafFuHTJpsOZTcPGFR+POS2:YfzW/ZbpRdhZN6Kawz7sQpR+P

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2