Extracted

• • Target

    69fe97255c127e68a214693a19c72125

  • Size

    855KB

  • MD5

    69fe97255c127e68a214693a19c72125

  • SHA1

    061254bbea53a9c0325cfa596d0a3e53e79b82f8

  • SHA256

    eeb62d009f6218f682660a9b3e30a9af0d493102aff9d697b24212d83fdddf46

  • SHA512

    c643eab676aed1a9c5d88a7d1a3a186eb5775bbc16f0fd2d1551f71d56387eef0f37b20a6fceb38d593eb13205a1aea86fbd49987172d463732d2f225da951a3

  • SSDEEP

    12288:CLmwXrT4E9fB9XAHsZnxAE89SnpVQc8Ts0TcK7G1R155wLrNDxsMNpJyEhYMueHY:3ynxwy6EQsFJ0AKA1X2NGq+4ICcNYk

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2