Extracted

• • Target

    a36bc70d145a83e7029a0b712a80a0240d7dd4536eb07ad21b5151b803785971

  • Size

    868KB

  • MD5

    28e39417746ef6b096db829021bf4d37

  • SHA1

    648e930721093eef9da3d75cdb1d75b81d4d3fe6

  • SHA256

    a36bc70d145a83e7029a0b712a80a0240d7dd4536eb07ad21b5151b803785971

  • SHA512

    241e699f86dfb894f8e9aa93ca0dddc11d465e7a0cca51369451384580e0318a2e210fab4802987969c85274c843107542fc6b4834888db39788aa51c55d258d

  • SSDEEP

    24576:lCbBNOTG2zroD3CtzNOZuNlUH87oHbMj:yGySsCtpO8NlC7

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2