Extracted

• • Target
    Consignment Details PL_BL Draft.exe
  • Size 436KB
  • SHA256 9ef018a18c99fc4a49c745386f6d25dcef449a26b2fe8a56eaacc418843f7f44
  • MD5 5e5e4ec59e76997893ebe7fb1abf5d2f
  • SHA1 8b9e4cb0dbe90009f3d37192facab6a1e5e96532
  • SHA512 982763d07f712c1942d28e6c04f9f9222b21a757aad1a901c6c969114e63d33d8a84a7a2a578cc9d4050cca5a2c6f5224f08730bfe6ad37b1d082c57cd118eb3
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojanpersistence

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Sets service image path in registry

    persistence

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2