Extracted

• • Target

    Additional documents.exe

  • Size

    883KB

  • MD5

    9ce7dbaa399c553d3fbeae037b810085

  • SHA1

    474b5c31ccd81f0e4fa74066b02595bf4648bc5b

  • SHA256

    c2ae8f03a4c70c1a976ab882238a8df26aebc713cd28e1896f883ea9da1f76de

  • SHA512

    ae079383015a9e0fb971d8ff7d77d712fe93d6b6c8aef6e20584308fbfb9b6429c2b299270a7361959dc7217b190458f3cfcd3bb2081069c81df50a68d7af693

  • SSDEEP

    24576:SUutasoWS0F8JVJu9Yna8PrGJ0XHLC/bqx:SUuYsDl+rJugFGJ0WW

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2