Extracted

• • Target

    10e1caced6af9870f33315489adfb5e411cc0ae8916ffd5a65b1113a794601e3

  • Size

    968KB

  • MD5

    0b2d88e41b43e04f3b6fb92e5b0e8e6c

  • SHA1

    6a8afb1a0091a4b49df2f54b8c83cfdf1a4761bc

  • SHA256

    10e1caced6af9870f33315489adfb5e411cc0ae8916ffd5a65b1113a794601e3

  • SHA512

    5cbcaf7e8c2337242bc7004b34a7f056e55da2c604147267dc514e99c11a34286f348d453b361d68addfec2e818d58279a6979f64a6d396d98919a65a340dbd4

  • SSDEEP

    12288:jmBHawEu3XDG2FaDOLEsvHCiec9a0r4NZji4T3F0l1o4/H1nDB3aGvQG0ijVrP:KgwTG2FgoNreKTUXi4Bq1oixnQoF

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1