Extracted

Extracted

• • Target

    11f419d637ab540e1f8979054681617d3e4adf28c30bfb5d086352b1c80e439c

  • Size

    674KB

  • MD5

    1647ac54fb1c7a722615b1fb92e19bf6

  • SHA1

    884abfc7f84e34c28a63786700653e3383bafc5d

  • SHA256

    11f419d637ab540e1f8979054681617d3e4adf28c30bfb5d086352b1c80e439c

  • SHA512

    fce853cf34d701307e9f3bcbfd0c171d6ffd25f4d43efe12b18ab0aa05abba5ab130855713744d9acd42b3d004fe457aac171aaa98613b1c51503c4a64c9c15e

  • SSDEEP

    12288:+CjMJrIFc0Ik/6SQ1mPUoLa9X2Q9xkb6/A8gzexA97+JvaHcMIEWE:3MJUc05/Qboub9ibL8WexAcJvEcdE

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2