Extracted

Extracted

• • Target
    SecuriteInfo.com.Trojan.PackedNET.1995.7086.13017.exe
  • Size 575KB
  • SHA256 d3c78007c8fa7de455de452208e6c3f487237162369a57f01e6a79b53cb19a9b
  • MD5 3dd8f01371795989ba0d00a6c83d88c2
  • SHA1 23be622e1a3609624d4e21ada34b96579828b66b
  • SHA512 81e21bcff45fde2cb501fd814ec1bbce6692e85d84baba722580b213f20add27337d79170c54df769a110374a337dcfd0f8f8b5752be95dca55ed49264c38661
  • SSDEEP 12288:KPDH20KfQW822ZAK8LP3tmlUd5+DMjqTkttmd:iDH20Kx5dm+X+DNT8Ed
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2