Extracted

• • Target

    c705dadf9dc655839e0778f2b05e191f41c58d288420095131fe2153e0cd9334.exe

  • Size

    663KB

  • MD5

    16a97a92f7072068c9345f16c1b841b3

  • SHA1

    42dda412b6af64273d1e55ae3008ca03fcf0072a

  • SHA256

    c705dadf9dc655839e0778f2b05e191f41c58d288420095131fe2153e0cd9334

  • SHA512

    100c7c8f3a95b21ca1f408b7a2e879ace27ace6394774ebd2c9a97c7ef47d75191ed191af083e014b264bf2da0b0c68e8448e043c920788dc234e41360ed66c4

  • SSDEEP

    12288:HriSAx5PWPQA4jcCxttjSUXcM+UxhCuJ8JBCu5XHxrHdm5OznueAWt6G4enCG0m:Hr7Ax5uPH4jcCzBjJJ8/n3tHdm5OznuW

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2