Extracted

• • Target

    0a232eac16fadbcea9f371d5f3832d808123297a

  • Size

    440KB

  • MD5

    40652392d1c0899c10858a9427423873

  • SHA1

    0a232eac16fadbcea9f371d5f3832d808123297a

  • SHA256

    72d186da41f7d6979ff9b012e4e5b5581da86946d60ffbc5870cc7b99dce192a

  • SHA512

    e4e9fe0d9bcf958cfca895a0382c3b87bc95d488f70faba6df223609ef7c5f22731beec930bb5e5789e24e3926b76292b8d47a165732a1d58702073ece18455e

  • SSDEEP

    12288:EYrIaib/25w27ww4vveYizJPWX+MBSFF/j:EYrIa6/2y1w4vvniZWueSrj

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2