Extracted

• • Target

    67a4fb3d712f983a6cb286f604c6c3a9

  • Size

    972KB

  • MD5

    67a4fb3d712f983a6cb286f604c6c3a9

  • SHA1

    1ac4619a455b339e778756ef733d744a7de90fb8

  • SHA256

    3b93cf2d1500295e4269ae32f0f5eb2b79eeb1bd1b05f08340bf691e40bd3d0d

  • SHA512

    c68228ae9c68ade041fb431d5ac3512a21389e5a51cb5f412d9dd8550c38d3f33cefc61a34b2d6aac7296817df5ea3c5e2a2ae951bbf2186ed63b6cb04dabd8d

  • SSDEEP

    12288:o1rg40DASNK8CZqU/uPDLm7KK49j/GbB9dBX0fV9YYFOkbwXaq2y3/ny4b:o2vAcK8CZpuP++K45ejXmwsO1K+364b

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2