Extracted

• • Target

    94645e6870be55af9df9f85d09aa0e8864a66989fbffaf02b705764b65f6ef07

  • Size

    1.5MB

  • MD5

    1037805eae48d987a6b8fa7a9957a23d

  • SHA1

    146bf657c81339bb67b15c46d536b587f25975e4

  • SHA256

    94645e6870be55af9df9f85d09aa0e8864a66989fbffaf02b705764b65f6ef07

  • SHA512

    5d7f8fdc978306044939e804c528a0bb745d0edbafe713524016fa00797d73f8a1d0fdd0f35daa450f3eedd26d2716f2eaf39f27cc7ee9e04166c973cd3e7b7e

  • SSDEEP

    24576:CAOcZBIhv1RIAhjLoamMiX4lNmZg0YxegPbUIDPPrAhhIpD0wo1B/wGdJunq3o9:IvjLoyEkmZ9Y14EDHo1VwGdJunq3o9

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerpersistenceprivilege_escalationspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2