Extracted

• • Target

    00eadc5abc36e748b8ada98d3d868688911459012dec484e0221c5fad0ac40e2.exe

  • Size

    859KB

  • MD5

    88fd0328401a429aa8c774d2710bf71b

  • SHA1

    bea6991eb7e32d4fd741119d2c18b2473587670a

  • SHA256

    00eadc5abc36e748b8ada98d3d868688911459012dec484e0221c5fad0ac40e2

  • SHA512

    240ebd7d93053ae2078ee73650dbbe09df07ba899ab431f9d615fdef92197ffd34290dc26868ea9e883ac86e9c45891e3bd2249922cd1bb8d97b7eea0a6d810c

  • SSDEEP

    12288:5I0wOZQASkg586aWHffgdy5boq+Vz4ZvajpSYsyu7sFZmLtoaDw0sMM:ybB5O8fggS1FCagY3OIZmLtoUBst

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2