Extracted

• • Target

    e99d17cd2b0e0e6f3094120940b3e0791de13701a8109ee472af9df0c8ae22b5

  • Size

    545KB

  • MD5

    e3030ed0b414451cce720ed2d3fb2842

  • SHA1

    3b2cb09283ae160e3564142ab81041bae5d5921a

  • SHA256

    e99d17cd2b0e0e6f3094120940b3e0791de13701a8109ee472af9df0c8ae22b5

  • SHA512

    49cc85ef16f9a39cf3e9b18c33142430a175a8b4c1cc5f4e84a6cc0efe4534a99790ec1523bf5b8533d698c9779006c7e5acc315bdbeedd7f9ebf92a9aa61e5f

  • SSDEEP

    6144:+GxhLLUnIBpvRjxiOiPUjNLByLx+iGFV46g0ZJeg8mGlN+30SvwH+kNF:3TUITJxiJiNLkLKFV46pjGC30SvwHR

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2