Extracted

Extracted

• • Target

    27786e9dc2494ab9d742775549d4c20f2c9107967b4693769c8138cc4a8636ae

  • Size

    337KB

  • MD5

    921f4b1ed09edcb9adf7de4234fa8b9f

  • SHA1

    75c915cd09559c102fd980e19bf81574555764d3

  • SHA256

    27786e9dc2494ab9d742775549d4c20f2c9107967b4693769c8138cc4a8636ae

  • SHA512

    c3b067ca0ff4a60a4afc429df32e6297e00ed7d82df92bb62b51876d963dbe25761c747960e4c923a1da849cb70a8e8abb6851accead3ccf58dbe400905a4b00

  • SSDEEP

    6144:YEfHpoXloiIXD/999ZMPLfDDMmGYWM+xYZrqyKuXzn2UsWYEMlh:YEvpoKz/9vZMPPDXGYWM+xKrUuDn2vv

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2