Extracted

• • Target

    4201e877ac2b8a647439434da82534b0ca5fbf7b6b47c127467e08ede45ce3e4

  • Size

    1.1MB

  • MD5

    67600a2cf6e129d8883d76799561df02

  • SHA1

    1fff55f246723c258e03fc2c71e382dbac1ac7c3

  • SHA256

    4201e877ac2b8a647439434da82534b0ca5fbf7b6b47c127467e08ede45ce3e4

  • SHA512

    795e133e4b246441496d569f76d523c5d60f1132558e3d9ff495bd8c19dff22206175d5e4249700f73bb3ff756c5680554b02355d45554c22ddfeb677a1e7aae

  • SSDEEP

    24576:O6GvclP07gBzekCfSbzUSy9VnNiPxhX49dXsMu:LGiP08Bzekty9VNqxhXAFA

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1