Extracted

• • Target
    Scan0165.exe
  • Size 488KB
  • SHA256 b501cf5c16de173d95ee0b491d5a5a7ab5a32135f60a669643aec169e6fd6a44
  • MD5 270e84bb58690dc60e47cf47d4414b05
  • SHA1 cae95b1b4ea6b1fdecd1ec0bff451a5a9c5baf47
  • SHA512 f218e105a05ed845d50329e8cfee700fa0c90a51d67f108c49c2446438afc782951c4905ebba95af7b13d608794837b9401e2a2484636acfd18947a2d20b9cd7
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2