Extracted

Extracted

• • Target

    ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440

  • Size

    829KB

  • MD5

    5d1c9a1d3cf698d5388abbe8eeeb6aff

  • SHA1

    0da3a5217e7072627b6111195933531869efc6a5

  • SHA256

    ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440

  • SHA512

    2dadc4a503cea21a4c669e1006a1deb15223a67aa8bcc4017c36c2ce9713fd2f508066e8bd3ad748e3ea03511109f08ef4baee1b293e1152904de750bb52233f

  • SSDEEP

    12288:uWVrltW8G34/uK45+po2WLfpjF+ZDMlwtMrj9pQkS5uy3x9IUONe:5o34/up+pJspMZwltVS1

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2