Extracted

Extracted

• • Target

    a6eae4034919359c04de1679911fbe0b6a03f769939b917553bf662e06a90368

  • Size

    1.1MB

  • MD5

    0a11b09136661b67f04ee64424f8052a

  • SHA1

    dfa5b6b9c7b4f281b51b21330370c1ef04153fb3

  • SHA256

    a6eae4034919359c04de1679911fbe0b6a03f769939b917553bf662e06a90368

  • SHA512

    d9aafdc84dcdeae3c8dc8c1b773a9d2468eac4a68d343856ec1e1106cf0b40aff2b47c00ab5f4b2bb92a405eebc6c0f99d8cfb3ee297f0533611ee50212463c0

  • SSDEEP

    24576:qEowEkEN6QlVZwzDyFmNXE4l5Qtn1DDE:LREkENXVZwbRE05INDE

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1