Extracted

Extracted

• • Target

    865cf5013a56a0576a1e837aae17f8ed232c6d43e21f91cecd31d21679f562be

  • Size

    520KB

  • MD5

    7eae5a91d3e871ea0c920f486e1343b4

  • SHA1

    74d80650070db49cb7da707666213c4d250e4190

  • SHA256

    865cf5013a56a0576a1e837aae17f8ed232c6d43e21f91cecd31d21679f562be

  • SHA512

    8bd825dca93e2cc74264ba964c5ffcf11f6553dd34a8c5cf7fb92077ead4f40842616bd9d099320a5816ee79cd0cbfda509b2aac57475d61a763945a57e0570b

  • SSDEEP

    12288:O0KVGTm0Ho8ayWTYXtqH1JF3xYJA555dj9v/3YEn1:/TpIPyBXq1/31555d5vdn1

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2