Extracted

• • Target

    Invoice N74561.exe

  • Size

    1.2MB

  • MD5

    a9c63220335a413f3968e2383ccec56b

  • SHA1

    a182bff10f22a7d04d7da5e03f4c99768b436176

  • SHA256

    59a8996eecd3446be4d9d67ac5adaaae32c80eb7096a2f24280dc6bf7922bfe8

  • SHA512

    bd6e361329af62e681b4ab0d6a2569a76a329d37a32036609e5f7311128e1e29a5009988067b14aff126231b46802c55025f4d5903edb4ee4852525b35b845c3

  • SSDEEP

    24576:kqDEvCTbMWu7rQYlBQcBiT6rprG8aDZ+B1blRPQ:kTvC/MTQYxsWR7aDU

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Drops file in Drivers directory

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2