Extracted

• • Target

    cab0d981559ec627b28ba927840774c66ccba4c7cea401d748ac398f0ab39c85.exe

  • Size

    719KB

  • MD5

    c0358fee59172c24e5695593392135e0

  • SHA1

    5b7a3dac90e3014de6eec3ac9e96c9534918bfc1

  • SHA256

    cab0d981559ec627b28ba927840774c66ccba4c7cea401d748ac398f0ab39c85

  • SHA512

    a2a7ff42f8294e83babc69d13532fc4fd6653ca084e32d1a9bb6c6da759c13a5ac782bd2a9802809756f703ce6de02582392bdef088c48df466ebeba403ab0a1

  • SSDEEP

    12288:aD+dIbgzk6wM4i0ID2Fld+lwrzS8dRm9LSuvnUA78WxKNQbCxOKL:aD+H4XMb0Pz3nS8oSuvUm8WxtbCx7

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2