Extracted

• • Target

    36b1c33312365c564b2d35908b47cc6ff03729cea329d347efb83365ab9cd572

  • Size

    270KB

  • MD5

    947fa0a4220dcac844abaa0d149aaf6f

  • SHA1

    e262c65c6fa159a27ecadec423fe07a4f2eb2608

  • SHA256

    36b1c33312365c564b2d35908b47cc6ff03729cea329d347efb83365ab9cd572

  • SHA512

    95ad2bb9f945f053e31787e66753b12c1fd35107ae9b441bb48d06fb3d6c86c21031b2e046391417e9d1ea2d541d2f92b2d8017c5560af083bdef69272a8eb51

  • SSDEEP

    6144:wBlL/c5bsFKd4xN3dRWrJYoozpSbRugzPsVKiyz:Ce5AEa6VYhpSgePQdO

  Score

  10^/10

  agentteslacollectiondiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/aneyji.dll

  • Size

    19KB

  • MD5

    f7a30cb571aa862021ff786169f72a80

  • SHA1

    d002635afeacd67ad2e5764d4dd07e0ec5f49ae3

  • SHA256

    3c3b81e2f3de386bb78562b8005fcc582aa83d1bd5ac99aca14bd235f401c018

  • SHA512

    7fc63a94a72b93ff57645d3e8c92726b7f77976ed5801461bfdaf4638dd8376565dad5f6663d1e0bd064e7521230b2b9f7aae90a5733f387fa003b22b501c69e

  • SSDEEP

    384:mjrLtiTvRxxt1BoXiaQxmCc1abG8QMqjfB4z:krLYTvR7xJxmpKG8ay

  Score

  10^/10

  agentteslacollectiondiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral3behavioral4