Extracted

Extracted

• • Target
    05ac1021e73f9b5375fdb6f124b11c49
  • Size 796KB
  • SHA256 5e1e2ce82b5fbcf65e9b5253453f4288dc8510fb30451f7f06258d7753bee9b0
  • MD5 05ac1021e73f9b5375fdb6f124b11c49
  • SHA1 8a0590f7e56c98585e07b1b2c1035dbd16ca8d38
  • SHA512 453b53f5e1455d5065a5d87072cf5d284f66b6bd4913db660dc32ee0565ee4be30de06c128536db21e77da9e650ae8796a38b965dbeea6addc4d8ddfbd692175
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2