Extracted

• • Target

    order.exe

  • Size

    1.0MB

  • MD5

    ab1a6b8171f7a1efcb1600b49dfdd234

  • SHA1

    f33bb81ccc85722f746980bb1b5aee8033aa4de7

  • SHA256

    01cd063d42c49b0612db611805a26403a9418e18f683321012809158bbd27742

  • SHA512

    d86e423e05dea38700c0452f2fe9fdd33f0d5c70f3df00681c359cbd72853ea01e900c9797e1cc78f3387060470fa62d383df1dde8ead184bac43c68ec2d1506

  • SSDEEP

    24576:ayBcjP6+BO3gdnpGL/QKxP4PH+0Cn3SB:Q9O30+IKxv043S

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2