Extracted

• • Target
    676841d9d559d269ce233595d5a028bd.exe
  • Size 1.0MB
  • SHA256 112dc41a2dfefecd437219db319a9359c036e1319a4361dcfa2f7e9b2d25620c
  • MD5 676841d9d559d269ce233595d5a028bd
  • SHA1 6839653c8693b81ec8825d2b77ff8d764efc94b4
  • SHA512 a662e20a092bb25b5d4ed0aafe4f3491dde0a3d7b02598213dead18e3631a10d9acb994cb46cbb066af738c3ad47d9b46fc4851367d55d62d41beb389dca96f4
  • SSDEEP 12288:+Eyiy2sz74MUBhVBE4SskO5DaGv8pLBqTRQV+qXQ2kJw:tDxsIBEzBOIKQV+ZZi
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2