Extracted

Extracted

• • Target
    ccfceedb023bc3a4c1f00a296c8d030c.exe
  • Size 693KB
  • SHA256 ed92cfb02cdacf96f67a4a7c97e0f26d37e7349be99aa8fc105bd3a608186e25
  • MD5 ccfceedb023bc3a4c1f00a296c8d030c
  • SHA1 5c3d0e9070e1fab0cc1e8624620b91f76fd6c600
  • SHA512 511a3f8b806a5b65a8dce9c8d95586616ef9a0e7d86b4ee59168a04a1c7154841dd4a73e012f7a4e937922e4bba38e22c1ed99e494c82b1611c1fc167f1112d0
  • SSDEEP 12288:CyalP5ZpEcYlm63Lq6J4jDUWdF2K0t9gmwIGkAT15q+v:OlrpKlEpUWdF2K0R+155
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2