Extracted

• • Target

    DOCUMENT.exe

  • Size

    315KB

  • MD5

    eda40702144ec2355291dccda48b7a38

  • SHA1

    36a59628463f556c08a803968f1fbcf8bf88f80f

  • SHA256

    b73234fec5a6cbf5e739a75ce9aa9674f11dd409a81c740f009e1bf18c767c94

  • SHA512

    69ed226fb392ab08ad45d2d5ef06ba315f065e54d51c7e87a9b5a1b0e5f17083de6b210f03e96cc7d7c80c7b807964c17fd328c2f476e4421763fe8cf1a6d21d

  • SSDEEP

    6144:PwgrUc9Zr8Ed+ioFyk9d46t2wICZZWrZyRbtU1TML5qXCTiKSK:jUcoi+pFyk9d482w1tU5M1eYlS

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2