Extracted

• • Target

    a00fe97cd5ca193f1a365788c31e1404ae58cf8d6763222d4e204fbbb5c28c4d

  • Size

    748KB

  • MD5

    f6506094f538588df177ee0a22247fb6

  • SHA1

    f7c6cd23f36bf0f2172e7a9cc4339c2823b044c7

  • SHA256

    b4548f80faa40eabc7185577225674cd1d12a69660fd5dd84e02cc5829212efd

  • SHA512

    23a6d6b2d2c2b78eea70438f9eb32b89f9f82def5467e1c923a75804c00b8f39edc7debbc8bc7f0fb9aba716a443cefe68e223d4793bc73969c6b9e455ba90dc

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2