Extracted

Extracted

• • Target
    e93ac87d732b9024cc2588ea59a25a60
  • Size 661KB
  • SHA256 94ba7a7fa6062f91a963dec2f064bc9803a08dc513ca9e528000f6fe5d46c4d0
  • MD5 e93ac87d732b9024cc2588ea59a25a60
  • SHA1 09c0393f65319849e5826507efaeb03b92619fa0
  • SHA512 7462bb22475066572d7641dbd5a84fe7f5d23442557c67e51f7fca0ee022986eaccc797c8d8f0a65a11961891c3e4f210bdb9e8c56d7d79b38571698a6d09ee1
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2