General
- Target 227a4456fb01401663152a26fe350696552d9e8b6800b0ae740f651537f51225.exe
- Size 1.2MB
- Sample251208-tnn55seq4v
- SHA256 c51687fb524469a5e1cc2a67c2e43691decf8a844cc7827cfdf276da1f00f153
Score
10/10
Malware Config
Extracted
Family
-
agenttesla
Attributes
-
app_add_startup
false
-
delete_backspace
false
-
enable_clipboard_logger
false
-
enable_contacts
false
-
enable_cookies
false
-
enable_keylogger
false
-
enable_screen_logger
false
-
enable_torpanel
false
-
hide_file_startup
false
-
keylogger_interval
20
-
log_type
1
-
pc_state
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
-
public_ip_address_grab
false
-
public_user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
-
screen_interval
20
-
smtp_attach
false
-
smtp_ssl
false
-
startup_directory_name
GLOZVJ
-
startup_env_name
appdata
-
startup_installation_name
GLOZVJ.exe
-
startup_reg_name
GLOZVJ
-
tor_pid
false
Targets
-
- Target 227a4456fb01401663152a26fe350696552d9e8b6800b0ae740f651537f51225.exe
- Size 1.2MB
- SHA256 c51687fb524469a5e1cc2a67c2e43691decf8a844cc7827cfdf276da1f00f153
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext