Extracted

Extracted

• • Target

    NEAS.9781aeef25933b2e60e350f984a7a06c916e9ce6e5ca2a38d2d3dd752357ae94.exe

  • Size

    813KB

  • MD5

    be3988bbf70d69b9d73d74bfcc8fb164

  • SHA1

    271f55af9cfa8b4bd0b3469940bd7722f2579555

  • SHA256

    9781aeef25933b2e60e350f984a7a06c916e9ce6e5ca2a38d2d3dd752357ae94

  • SHA512

    0288f4daf6239703ef7af17c549786bc14f6999f2559644c5f5668be3557fa4b5d0230bdaa69f4dc8a75f3111654dbe9897d778e8bfb3298e6c01159dd5660aa

  • SSDEEP

    12288:I9dILurOuKPQq3FUJQrGvZ1gSAEfBMdlQduRTg6Z/4eb3TSGhgoFJ2W:I9ZrByFMdvZr5fiRTg9q3ThgA

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2