Extracted

• • Target

    dea96a38aa4dc66e53b3aee69d5ad8c56dc961fa03172cac1794a888ce3508fb.exe

  • Size

    915KB

  • MD5

    d7dfeedec9a091e5a9fce3e3db93a006

  • SHA1

    642702465eefb4b4eb430af8e1c690811f3b0836

  • SHA256

    dea96a38aa4dc66e53b3aee69d5ad8c56dc961fa03172cac1794a888ce3508fb

  • SHA512

    272b173a1602b32cac96bacf90b13496451e05edb56c05a55fe9b87221a63dccab92c9509bebfda26a8ca7c2729f94af029e857dffcf2e3c102391331c024d77

  • SSDEEP

    12288:e1ExgKPSvX7zCxcoirdwHwhjm+2c1a2uVXpfF7QOYZFkDOglzAKpl:1G0STGxcacjahDlDpl

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2