Extracted

• • Target

    6b738e452987595797cf0fa65d60a4ba63c8e4764ba14147482b63e83cd5a09a

  • Size

    696KB

  • MD5

    6398bb02b34145165929c3d2fe2f5bbc

  • SHA1

    aeacaf10db684de9409c1c9a189ef6b2a5e96c6e

  • SHA256

    6b738e452987595797cf0fa65d60a4ba63c8e4764ba14147482b63e83cd5a09a

  • SHA512

    7b8eadb6b752ef7698a903fbfcdcd1476f72c54b07abce5a226899c3b20c8780cf4335c6d20c3d9697d041be7c7ba6359801716e06634b4eafbf82e4840a7f43

  • SSDEEP

    12288:9Ul5nF8SUb4YSlZFg0snznRwKQLM3Fe4M4t9lbXOAhH1pJdO8jCf/x4dqrlbZnK:ylubyZsn7Z3PM4t9xhL6HxHhbZnK

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2