Extracted

Extracted

• • Target

    d03b8c0fcbbdc16e4c7d5794c037ad639ce4c55aa42fc1905c179c4213d0b04f

  • Size

    1.2MB

  • MD5

    6c2ca3d7accb6da47d068b0810fbce69

  • SHA1

    4777ec71b0afe86075499b31b031e7944165679f

  • SHA256

    d03b8c0fcbbdc16e4c7d5794c037ad639ce4c55aa42fc1905c179c4213d0b04f

  • SHA512

    16f1b1fec42916f2e6298e174fd9d22ac2107403528d2809f2a44443dfb03fb1d335212955cfecc16327338fd1ee0f7e04b98bb6f167ffb02f278adcf7bc7a9d

  • SSDEEP

    24576:qlLJ4SNTHDKDqe9Cre2xZBpyirq8YdSS:cLJ4SJDKDN9we2xZ7yiW9d

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1