Extracted

• • Target

    ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86

  • Size

    631KB

  • MD5

    ed4b8e965a5e8a2b185f38a2dc7b5c1b

  • SHA1

    4f9a24c87e5cea08769b8ba5559c755f9a8749e6

  • SHA256

    ede5c03ac90316dd72af13836732e0749659b483b3a400f73d57a62a4e3b7f86

  • SHA512

    60c0518c3c6436889bee9dcf1cb11db8cbfbc2ca37aea8a245c1ba18537e079ed92a99a746d6a370d315daf6d7204ea7985a86da6bc827421cdc54fdf1ffe055

  • SSDEEP

    12288:j45+po2oQpPwiViAQZb9EuQlbmtDaB6x/rQj0fBcuCA1YDL4o:i+pJhpPwT1ZZEuQlatDaIx/rQscuDWN

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2