Extracted

• • Target

    cded71748f0c3329dedffd3480c06b1e2d4a6de041fb8f57d79c0804a13c66c6.exe

  • Size

    459KB

  • MD5

    f3479cfbca6b45b517fd0fa008c808c2

  • SHA1

    eb0652dcd03ed1a37680d2bc9fcb1952dce3a056

  • SHA256

    cded71748f0c3329dedffd3480c06b1e2d4a6de041fb8f57d79c0804a13c66c6

  • SHA512

    3c512ee62d1b21d03550a013003d210a099abcb1639bd8087555d339d0475881f15e102ef31b59552cb42cc250c3bc182812d4a6f75929a2f4df81cee4259a8e

  • SSDEEP

    12288:peDy4DNVdtaMGWWVJtt/sooIcXwHQSG1hQjYZIgN4DVZdc8J:p8Dd31qC4cXwwSGbjWP

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Drops file in Drivers directory

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2