Extracted

• • Target

    814987d59c50f28be419667cd254beedc3fc62f9a0f7f54bc0fd1e862d22d3f6.exe

  • Size

    695KB

  • MD5

    3efc61445f72e06ae9efe194641fdead

  • SHA1

    20dbdd12e2ec9499063e2f2e4a6c9ed36c058a2e

  • SHA256

    814987d59c50f28be419667cd254beedc3fc62f9a0f7f54bc0fd1e862d22d3f6

  • SHA512

    f7e9ccb21bcf00fc123fe5ad72c3438191b91a746394445b60fe19366a7aff88cc8be599c1565c8483afd015f3c26903d36d89b58cf74f1ba2cee84d8ca36ac9

  • SSDEEP

    12288:hJQmbCp92iNIAPMjMVynMmKFYupMbGLmv6RYtmv6WETDVSolSvtYdSZ:hu19YImMxg9CMmbEFSqeuo

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2