Extracted

• • Target

    9549d97eb752358d01342132fd4605531f199ba9a5e9e366dc6063d75ffba5a6_JC.exe

  • Size

    1021KB

  • MD5

    b6d67fb82d931b66adf46c4283186677

  • SHA1

    7d2c57618e544c0eb7fe8c3ec0236e2b355a0c2f

  • SHA256

    9549d97eb752358d01342132fd4605531f199ba9a5e9e366dc6063d75ffba5a6

  • SHA512

    072551d3378595ce6691ea4be52054ed3e283e6e58b477d5575e65c5785daa924848e2940d9cf457b0cef5afbdcc7006ceff16d426f4d3b511569e31e873e9b0

  • SSDEEP

    12288:Qd+oUK2iNtj5ciCDC2ymkOQmqWfWc8qnudcFizc4YDAv9A+:7oUK1/eiWCBmkOUWdudcFiz0Av

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2