Extracted

• • Target

    759a1832c58e3cc0896a2af170b513f587e8eb60d72a331930867db59145be6f

  • Size

    454KB

  • MD5

    eb94912fd3ac900f81acc329c4eaecb6

  • SHA1

    f24b2a19e8b992c6136e91e2796acbd76f31e78c

  • SHA256

    759a1832c58e3cc0896a2af170b513f587e8eb60d72a331930867db59145be6f

  • SHA512

    ac5daa394792bb9fa466a1dfbdf6b333de6557991f0d3c848957e22a4cad36101d09bb93c91769659637744a4a6222d360fccebf69ea57c13195de73178c2d87

  • SSDEEP

    12288:sfSTiyowD/ubIillzktNazP2LLz246kkVQqUQm:OKVW04RktMjeLqkxqU

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2