Extracted

• • Target

    b34970457d377b77be959128a97a4421949d66fb563800bd615f1eba73ac07b9

  • Size

    727KB

  • MD5

    39f9149362c3bc065e63bb4f7b0de153

  • SHA1

    4995f754e2179356f419bd7626a14319823acf62

  • SHA256

    b34970457d377b77be959128a97a4421949d66fb563800bd615f1eba73ac07b9

  • SHA512

    7cb7ec5df709b944fc30a52ac1c4214fe0a459d58720b2799d6111e4f479ca06a20bab827bcef3948dd36a7e8a12e6ad499be0d867441586d7a3daf2cbe4a36d

  • SSDEEP

    12288:w2mKE6jD/62iNG5nF8C6yxwvwPTwlSCiZfb1cTdte:wLKtD/61I5HkwPckCiZD1cTdt

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2