Extracted

• • Target

    89e8fbe1e27d4093226f281fc48da079f4ef927f23d8c755a520198d2cff6a80

  • Size

    1.2MB

  • MD5

    0b6124fcd44cf9c203e778a4006ef172

  • SHA1

    2f84aaf2d110c6058c9cf7892efa68d0b342a08f

  • SHA256

    89e8fbe1e27d4093226f281fc48da079f4ef927f23d8c755a520198d2cff6a80

  • SHA512

    da300d4a7396fa7a0e81def9596e95cd64a760b041fdee3266e66ffbc008d99d36c9082c919eee26ed3d20d491fdfca4718698fa4672e5fb9d91753a775b95b1

  • SSDEEP

    12288:4lFAcizTSbgSFrh2Sf9RW+JlxNgLfV57LBCRV1M9JaS8jawEamr:4lFBmSbg0fOyWNxiIF

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2