Extracted

Extracted

• • Target
    b2278edc219f12ebfb7cb2ffd8a7b553.exe
  • Size 1.2MB
  • SHA256 0e259105a3b2dbb7de38f7c9257504c810b3ed757d06952b3e55b91ef80e5721
  • MD5 b2278edc219f12ebfb7cb2ffd8a7b553
  • SHA1 c67bcfd6b458d1f478c4565ed35156f294244bf8
  • SHA512 689b6532583127dc4fefadd59f08e31fb6c9e3a56fc580cf0811d2f9a101af5458698c1fd844588eeeedb35f80d71c2a8ec8b6d6faedcde97702f43c31b0352f
  • SSDEEP 24576:riAXH11J/5fFwZgXC1l0I0u5qQMTBWDszXs7:tVr/5fF8gXC1l0nkWTBDXs
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2