Extracted

Extracted

• • Target

    bc1bea4f587d11c75adde46b9a53d5cd33d22928f899eccd004f23754ce98303

  • Size

    975KB

  • MD5

    cd9d173c47be216dbfc18aa88972cc7d

  • SHA1

    620130b3213f5c636a3f3176697ac0b70ef366fd

  • SHA256

    bc1bea4f587d11c75adde46b9a53d5cd33d22928f899eccd004f23754ce98303

  • SHA512

    216bc84b8d542b0ac7187ffc91d09ec3beef432b3e52d0324742aee3b17d3142d87d54f146a90b175ed9dd524591217413d37b60d9fbd8fa4ce39e4e4ee39e55

  • SSDEEP

    12288:oHDH/VsMkDvYHPCKTpKYq8nopsgPoauy3ViwFe+ZfBNpYLo0H9DI/GFlx/:s7VsDkqKl7znoTA0EwsCBNp8on/Wlx

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1