Extracted

Extracted

• • Target

    81e34f31c5bfb079cee0ba9562e3916f4eb71f1d043485e96449ecb2f40acc0d

  • Size

    924KB

  • MD5

    7cf05d8ad9aa9c4ac068e74d34fbd008

  • SHA1

    00538fd88c39cd0225391b14bc0840e3aca35c0c

  • SHA256

    81e34f31c5bfb079cee0ba9562e3916f4eb71f1d043485e96449ecb2f40acc0d

  • SHA512

    5db8f605ab51661865686b46f8c45012c0ca34148a5ff18a06fb23552a7191124977ce29319c71d2cddfe6ca65fa9b9a65ab2b6d1a996648b73a055676778157

  • SSDEEP

    24576:JvKmIiUwb9kloxA+M58BTOOk50YaI6ab3:JCmI5wb9/9TO15pB6a

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1