Extracted

Extracted

• • Target

    SecuriteInfo.com.Trojan.Siggen21.10722.21572.6770.exe

  • Size

    812KB

  • MD5

    2d914aa8e3257baee5a6d7ffa629b446

  • SHA1

    c9df8d51fd3a47cfad0fdcab46537bbbba4b5354

  • SHA256

    f2f7a27696bbccdc3c8c3e3f73dcb15c9045dbf76424e11b09146fd1b488dd9d

  • SHA512

    b553ea7dae9a184b208a11ab782d288c8589838d6508e075579f9ff28db331bd0c764e8a82e76771410a4f525941d5382c74a5254274899fcf4e6e9ec51520b1

  • SSDEEP

    12288:m3TXmmhR0VXYNnvvq7/L0liaI20lyc2H28Xjj3c335/lS1Guq3:4LmmhRhg/Lf9lyc58Xjj3cdlS1B

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2