Extracted

• • Target

    18ff7446c538ea6c96f148a12b2a214f9823d7e4061c2f3d350cd81e6a8de8c5.exe

  • Size

    689KB

  • MD5

    3c6b3c50afec4a49e616569559d4a749

  • SHA1

    9f5844d3f48eee948e371d4f527b4459b3323f73

  • SHA256

    18ff7446c538ea6c96f148a12b2a214f9823d7e4061c2f3d350cd81e6a8de8c5

  • SHA512

    4f12fee3499145d457058690ab7c4ec280d7fea46eb5113dc3e970b3efc3f3e0637a6e227e6917672c62a6615fed016235c92b5b8135d1021660fa1b33055765

  • SSDEEP

    12288:wq8o4AJwATF0VN+B+xMuWIatYJrcAlZS/XJjxAl/LLOEiYFtY:UIhTF0VxMqJXMXJNAlDLO8FG

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1