Extracted

• • Target

    4446d1f062cab8dc96e1acd4b96b609b

  • Size

    819KB

  • MD5

    4446d1f062cab8dc96e1acd4b96b609b

  • SHA1

    f57863b9d4b8c551c823f0e9c114e21fd4f58942

  • SHA256

    b3c30689d3b12f79f23a67d02f5f7537898193af6d456d53805ece8115163ecd

  • SHA512

    72eb344848b0cfb225f61f737eaefee40288eab119db481150cab6fa4fb4feabafd62994b7f25a8dbc1d714dc7aab90c06129ef9bc23006c8605e9db4e8f573c

  • SSDEEP

    12288:7/jGQA6ZUoR65AXwgFvuSS3II5u+kUTvyQ15xCiCkCtwsTSbap426UAveHltzCQw:GoR6qgx164CiCzhm245UJDCP

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2