Extracted

• • Target

    4b0d7d7932c2361c099955820fefc4636459c3ea3b155746fc04a7193d96e5b3.exe

  • Size

    216KB

  • MD5

    406165d534ab4b717a48b274eb269801

  • SHA1

    19715662668e29937e6f771b9caf2e209a75b43d

  • SHA256

    4b0d7d7932c2361c099955820fefc4636459c3ea3b155746fc04a7193d96e5b3

  • SHA512

    ace6162941e11a0924a2c708ba082f3ea944251bb80f270ef8850765d9491a2589e005fe1d4fa5f065d44391f919ef98600a17c2fc9153c39f21042990496f96

  • SSDEEP

    3072:/YYT0Ot0CBbSd3QA0nLAkDyppzNUsyA3dueKDtKK5zHKz0m0ZnYxY67E/xp+://SCxxLtqhU7ANuXtKSKIm0ZnW7Ixp

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2