Extracted

Extracted

• • Target

    06d2820b1267ae2cecb3bcc76e2a7898.exe

  • Size

    1.0MB

  • MD5

    06d2820b1267ae2cecb3bcc76e2a7898

  • SHA1

    92ea23123f70bc49a80bf3862081387ac5668e89

  • SHA256

    9a1776049b09113bdab8dda7852ab6c8a6e7bfd04bf78093b3d0dfc4a334d701

  • SHA512

    a77781c5aae7e7e3ebbe7765377529f138b34ae467d6ed8a382d3daf24412fba3945e40296ff807c832f667eb1a8dbe63526f2bf9c18802186e4caf028665abe

  • SSDEEP

    24576:M9Df0G98kn3udNi3ZUUJpdW5eETRuyRzS3cwJWYvWpFM:M9N98qudNi3Zl7WLT1Rm3cwJWg

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2