Extracted

• • Target

    7f2bd5ae74aa8c987865c6e8e2ba9f92b6cd157cf285c6f545755bc7158b2cef

  • Size

    679KB

  • MD5

    143bcd7eedd7bba4d27a270b7e3710f0

  • SHA1

    0ca36b8a46dbaa099d75e2a9ff5aadffd7924f07

  • SHA256

    7f2bd5ae74aa8c987865c6e8e2ba9f92b6cd157cf285c6f545755bc7158b2cef

  • SHA512

    b6ab3b6105b9d35d8b12dcb7a392b7b8334f66535fa288faaec16ccf772f0d68da1ffb9bd69eec36d6c4ef3176eadc03529e5072a4263e779a20ef0fcfc80458

  • SSDEEP

    12288:+645+po2MHuPxYXmY7yAkwzY4B7haW2z7WEKGxtja9I:+Z+pJHRoB7haWJxUkI

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2