Extracted

Extracted

• • Target

    b2b5cd070a9c6b85d3ff1b547c5e4d88bd9f1cf7d6fd2fdae2213774e3573f0e

  • Size

    1.1MB

  • MD5

    ed9fe7c531c4e526541acdd95a249870

  • SHA1

    d31e641bcd5ad07cb18746c65cb2f3269e1386fc

  • SHA256

    b2b5cd070a9c6b85d3ff1b547c5e4d88bd9f1cf7d6fd2fdae2213774e3573f0e

  • SHA512

    137292dc0b7215c74526d48fb5493d15149db6ad7bd27d55fbbee5b13489dea7c7569b95a6ed8f4a29a810d1bebb833410403241460c8527de686ea4ceaa9fd8

  • SSDEEP

    24576:uqGnN5JcEU7aLEV5Ukgh41kxLFltuVp3RKEjMEKRoZOeBcf:AcEaayCDDuTB1fyoZh

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1