Extracted

• • Target
    pOatakYsZfzqkaR.exe
  • Size 832KB
  • SHA256 339ae2cba0f3ce8bf4b3098daf78d5e4bfadeeae26762c697bdb63788927ee77
  • MD5 8ad6b210723894734d654ba76605b8b8
  • SHA1 7becac332e34078e04501a407a24c7948f3c6a66
  • SHA512 4185ccfa753f5216222c3d9dedfd90e84860fd1b30386aa15b88f22da4b7e40eb4883d074db44d071f8cc8ebdfe38ee661f233e24204ed98e938bdb282741ec0
  • SSDEEP 24576:buzu4CZdOlikKT6bLW/0GHPARTLFQsls:Sz6ZYllKT2JG4Hls
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2