Extracted

• • Target

    Q2849-748.exe

  • Size

    917KB

  • MD5

    0f844392d397dc7fa5110d437954a891

  • SHA1

    7e2557d4dbbcc92633883cb7d68bba1b5d6c6e27

  • SHA256

    8373691997253a144ab7c2059be27c2b1aa3e2172c424058cba3df514f9903b0

  • SHA512

    1ff5479fc3d3dee18820acd9381e6fcd8758e9e9fd058a47145986a025ecc772140bfdd601486148cf42a98018568618431c6147227ee3f923bc93c7712a76b9

  • SSDEEP

    12288:acr2iNwl+bPoOrJXdvGo5u4S0IGP18wHVP2l0Kl2nJEqR7miLByqzNMPVgURVrDt:Zr1W+bAqFG14S0Kw1WSnT9miLBI

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2