Extracted

• • Target

    bbf00e5d04d29ebf5fc920b7bc238170a714f3b8d0de3054550fb146468a16e6

  • Size

    631KB

  • MD5

    2ed10c1ecb18c82e28180b08eb96fbc2

  • SHA1

    36175c06ce7491b04d65598999278efa98af86e7

  • SHA256

    bbf00e5d04d29ebf5fc920b7bc238170a714f3b8d0de3054550fb146468a16e6

  • SHA512

    bac104ab9e0109f911fc759df412c58be940979f462b388f7b41248164701dba19ba2621385106b6b933d91bc6f28c712f40b11c31277081ecd78dd44b439642

  • SSDEEP

    12288:61Bao2Udji9NrDiEkPdsX/HG4Yvv6nQITSaNfNBLEK9+1oq1ZJJqQR50CBB+3BRY:Im9N6EkPdm/6yVTSaNfNb+h1DJqQr0CF

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1