Extracted

Extracted

• • Target
    0fffaa8699a3772768a88fd093cb08eae96c3fd7d694f4c912c9fabb472be073.exe
  • Size 1.2MB
  • SHA256 0fffaa8699a3772768a88fd093cb08eae96c3fd7d694f4c912c9fabb472be073
  • MD5 62071a7fa79a46a3fd6fd18e6295c1c5
  • SHA1 877d860d8241cddd5ddc61ceaa0a1688fb6cfed0
  • SHA512 c90a83f34b892cc02e4eb9cc332a8a32fb65020d48f617b05fcf4b8dd4a454c80087b8f0340800182e7b5cc748a2e58f9f0780beb49a159f0f66f8af5f2a79f7
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2