Extracted

Extracted

• • Target

    pics.doc

  • Size

    52KB

  • MD5

    4693b7ba6d5e31918330284d71f818f3

  • SHA1

    6e0debfe33f47802307aa046f44dc43629b33df6

  • SHA256

    fb3221e17abe8facb098a47f9fa8ff242a67b63a01ac7c97525ff8f266fb9ac6

  • SHA512

    cc336cbc08ffce55f4fb54aa1b6670a55f7087c38d27c18ea55764e9e8ff125cdc6fb9793e1884d419b4d90dafc561d29da7eebd118f11c648f08392209d5b2e

  • SSDEEP

    768:qwAbZSibMX9gRWjKEdX0PqLNoEBdw2SnVgcc6CQEJ2:qwAlRTEdXAqLNoEQP+cc6CDJ2

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2