Extracted

• • Target

    47997b57def6a9437ddfc2ee31e74653914a39113fecf9eb248516fc7bca0f20

  • Size

    485KB

  • MD5

    fd70f094650ff766b72c2b17608058f3

  • SHA1

    d49bc06de7339d122a55475750df7ab2dd94d1d5

  • SHA256

    47997b57def6a9437ddfc2ee31e74653914a39113fecf9eb248516fc7bca0f20

  • SHA512

    2c2e561b1721866eb2f8b5a3efe61f1b19f94208320aaa650ee7a6f5c4884919bba0bf128f3c5a0bec7ca5e2ce2f95c721a976733353cabf2709a2cf37cf2c37

  • SSDEEP

    6144:xesU4bHXVHUWTy98JhrpKBtkuM/kmOU9Ku7hcE+AyVXPH4miIlOzzBFzhwwXHPXD:xeJ4nO8Jh1KBtkutm/V2RPehPe

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2