Extracted

• • Target

    IMG-20220926-WA0000000008....exe

  • Size

    882KB

  • MD5

    a5e9194aebaee807a27b58dcc1a9b000

  • SHA1

    94932b210e64a2349f6e824631dcc8298e719e09

  • SHA256

    c7e5612eca504249bfde7ecc7bcdb3bb2220e9f0599aa675b6acd939d29e47bb

  • SHA512

    a9df6bf6dc98d11d89b31d353a7dda6db76906940b2b181961a42fa5f57b1d560e297f4d737bb80f18b43e5d41e8017379ed9acfda4835a5fd80af9e0e945d2c

  • SSDEEP

    12288:V7C+LVFcxr4tlKD9xK4oIl5j0Ne6Oz2NUMfyTiADqjJ5nu9H:BCWVF77WvXoIfoU6KMf7jrk

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojancollection

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2