Extracted

• • Target
    84022000.exe
  • Size 687KB
  • SHA256 8866f6c589741b658ffd084aa66e2ef4b34f84b40238e7d60e2acc5961cf207c
  • MD5 9f5c1c72a8f48ac8cee9d2c50357824b
  • SHA1 3a8a030b56848af1f0b5bcc16ad3c3db4a87be16
  • SHA512 6c4ce9151089146d6a34d6ee0a119d24eade230b2160e3220dc680efbcf9d2a17a95f8b44ebff58fbcada4bd824d1942972329893c2229093a180355f23769a5
  • SSDEEP 12288:IsIdum2iNfmFx2iqNhujGjUTGRd2mbdZadNqi9VRTsSqrZ3xjabyPK:IsIdum1lmFxUpTrXadNqir5s5xjIyP
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2