Extracted

• • Target

    16e9058e3a0c9157506540ec13931c52861661f699065b210978f4e6a935670a.exe

  • Size

    594KB

  • MD5

    6530253594ea708f5666107efa50262b

  • SHA1

    e3989e8b4acde6263b7e669297210f4451db6634

  • SHA256

    16e9058e3a0c9157506540ec13931c52861661f699065b210978f4e6a935670a

  • SHA512

    2941a311a89368c91e37fffd4beab64fcf1e2690a8bca41d9d98b4ea33add915d9f3c1ba942d2e413d3b86f2b6b2bf6a9cf162d9498938c6674cc859082d87d1

  • SSDEEP

    6144:Gp9XAMEvBvp5ie1c89k3er+oheF8kYrQHoL43kEaVteaIHrcq7WrBlmQM7VQysga:U8Zvmgc8y3ntYMI6kE6teaq7EBlmZ1Jc

  Score

  10^/10

  agentteslacollectiondiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2