Extracted

• • Target

    7428cf1032e1f721a99c20844e61417d354002f2439e3b240c1fccca5764c998

  • Size

    1.2MB

  • MD5

    b45cff738ede029e07b9999764233a1f

  • SHA1

    e05cbdd2e8e188ac15a0cc20e214b17492efdf3c

  • SHA256

    7428cf1032e1f721a99c20844e61417d354002f2439e3b240c1fccca5764c998

  • SHA512

    976d0362e56b1dd0d6487acfc6b00ab4c9e0d532eb02139c27c4f538cb56525d66c4de1c8a70f2f8fb999fe6bfddcbf90c927d3af221b79b6de20c97e19fa212

  • SSDEEP

    24576:yOR6Uzpk4DdsvLv1RIAhjLoamMiX4lNmZg0YxegPbUIDPP:yOR6H7ljLoyEkmZ9Y14

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerpersistenceprivilege_escalationspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2