Extracted

• • Target

    198a27bb3eafb16e85363be12dc849311bc4e25043794c5ee1364f2422dbdf4dexe_JC.exe

  • Size

    699KB

  • MD5

    9a3cb6c4e08b0a2fc307a5eec8a3a686

  • SHA1

    bdfcb97ebec40154f9cb348127099c964b41f098

  • SHA256

    198a27bb3eafb16e85363be12dc849311bc4e25043794c5ee1364f2422dbdf4d

  • SHA512

    7fa78e212d40fe314d33e6ef43a048ab26a1286e6250ccd675cb2ecbfb2de9b81b869dd5de17ee5118d7d2f948d53b3ebce8a81bd52070ca47b2b9259e52b3c9

  • SSDEEP

    12288:t+uZFr8YmJ+37MZaFOgf+OQSIYOcvg4uKfeN6XTHLt/WnkVYEUm972OQ:t+uX8YmQ37MZaOO3ycv1uKjXPtwkam9e

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2