Extracted

Extracted

• • Target
    a4d8caed23cf05d31bdeb32f10fed352
  • Size 565KB
  • SHA256 c07e61df73d45ea51cac71c5ddb1c35ca5fb7f97f562089a27aef05c51e43a2a
  • MD5 a4d8caed23cf05d31bdeb32f10fed352
  • SHA1 db9fce55cd4c68f86fae69de5c7c0682a1978f2a
  • SHA512 efb64af37befac0f9a8d652a527290f5a8130b9a99784f2f8c9e016a8b89366403340d3ad328fa51b2b74696c97c33b9d280814008cd5037ca05b6e98000538a
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2