Extracted

• • Target
    SecuriteInfo.com.W32.AIDetectNet.01.15861.29917.exe
  • Size 1.2MB
  • SHA256 03769c014c17ced8eabe8d2bc442c7bfc5e211e817c1ec9271654d9aec164ea2
  • MD5 857229535073ac1caeec482346c7597a
  • SHA1 7e5dddcfe7c732f85a5c0520d7f5e27918e17824
  • SHA512 624a93586f0617c44c6f0dda20a3b03d5229a8869372368eca29154377a31e39bdc9a3454acbec25f90c030440c7d661466d40df57d91cec65c0f15347c92eaf
  • SSDEEP 24576:/Z5MXY+mzo3bvoxqHnFDvrNeOxsTBpzVMA3:B5KlmzMQYnRvrNEMA3
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2