Extracted

• • Target

    6d7383506176b2d66904efea5dfee58a70ad683ee01d9bf6a49066a92ab81cf6.exe

  • Size

    1.1MB

  • MD5

    ef3b33eda19bdf6cc936b97f7e582f1d

  • SHA1

    2f67db5fb6220c97ade8c9a016e0553af766efe3

  • SHA256

    6d7383506176b2d66904efea5dfee58a70ad683ee01d9bf6a49066a92ab81cf6

  • SHA512

    975c729679891c2552d9f444a6f68f80ca122c6476599efe1b257791695647577c7b003146ef5dd457ead393d5da42b74949a6aadb514d24847d5e4bce1924e3

  • SSDEEP

    24576:0RmJkcoQricOIQxiZY1iaae3Ut4xK9+UfLWYG6uwiQizOVEC0ZL:RJZoQrbTFZY1iaaYQ409XmZwnizOVa

  Score

  10^/10

  agentteslacollectiondiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Drops file in Drivers directory

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2