Extracted

Extracted

• • Target

    ce71f6f91733f2be9c884f7b3416bfaf.exe

  • Size

    725KB

  • MD5

    ce71f6f91733f2be9c884f7b3416bfaf

  • SHA1

    0a2ad751d656b7cbb7980ca7006bb651cb9e8c92

  • SHA256

    7a7ff26b66d38cc6f04b3c37f6531a0ad742a1547b7bb8f13fe0f01abea834e5

  • SHA512

    5e280d523cdd2e8d7b563f590d626073ebb194e84ba089f0638daea86fe7e9df51af9263fde1d00bdb5820a3b08f825dccd1f3444360661151a980c70893606c

  • SSDEEP

    12288:pbdINmOTqKDENQcbMCVkmJvEIeeGBux7ANI/LhhyD+B/P8m9:F2NTqmgbM8xfeeG/NI/Lhhy+XB

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2