Extracted

• • Target
    DOC73287284262.bat.exe
  • Size 527KB
  • SHA256 48e030cc0ca1af0e027949d1f16b86226e352065d9bf5eba4ca7719efe61b0cf
  • MD5 7957ee20f42e7158e0fd2cd73e17b436
  • SHA1 aed7c6736ede54b4d4eda9ff3cbb8e510eef2a88
  • SHA512 853ceb5c1465ff9ec2df913f898710795517f5ca7b787dc63e9b9483d72785311f954e886659dc7592ce74269b65fe93e958ffde4935cf2cc7625217dc0f8fff
  • SSDEEP 12288:wuvgIb5G6uxzXlsjuapg2dKhtjWHmYZeIwEw:Zu52gDbYS
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2