Extracted

• • Target

    Overdue Account.exe

  • Size

    1.1MB

  • MD5

    cd8b7c72ba0756f8e6477259d399b960

  • SHA1

    d3e9536cbe68699c134823f4730e9a388b403b3b

  • SHA256

    e50738bd86a1d753a2ccf0e88cfca85fb58986ce16cb9db779e3cbb45e9a4c07

  • SHA512

    0abb609b0d5d946ff7a1c884bc533cf764d92e706cca9438e10b45570af402b3e29defc70770b31a716b93676305fdec142cb0f15ac493a82d2cddaa544e5f46

  • SSDEEP

    24576:KyBLjP6+b1EyCGcZV/zerKsAEUVTa9hJz7H:rP1MT/SujEQTKD7H

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2