Extracted

• • Target

    5bdadce085b73766cf05df40b6250b2e0bd4dd5b238caa5aec6588654738879e

  • Size

    886KB

  • MD5

    ca218988e6028728d44f7aa2c0df00cf

  • SHA1

    15a06317fd28c706882d48e65c02300c953b980b

  • SHA256

    5bdadce085b73766cf05df40b6250b2e0bd4dd5b238caa5aec6588654738879e

  • SHA512

    d574d4eb22ddca26b0f82af62ad17edda167ffee20d29df74e142a436773f12e13706469cd31b588ac75075db53efb537b2838aaadddbd3bb4e91b5fb5ac3660

  • SSDEEP

    12288:nWl5nF8Koyqt0PmLGB8RWQ/nhnjElIlo+pYvk5tVK64dqrlb3:Wl/oyu0PmGB8F/nJIlSWvk57K6Hhb3

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2