Extracted

• • Target

    14574a9738c892b1cd8bacb8ad088e30

  • Size

    1.2MB

  • MD5

    14574a9738c892b1cd8bacb8ad088e30

  • SHA1

    5ca4ecdbdec2be16b20ef68bc4461b4b1922cc25

  • SHA256

    c543aabeec926dc171352bc27671402e72be4f6d21adf528ed5469832c0559c0

  • SHA512

    0e9bf942cc32e023cdd577b749c2cb98c420c137e2ae7244df3c3e43aacffc8b2f30681594be60e75b4c4e8d4eb7d6a0e5a901e42cef886cc1cb69d80c8539ba

  • SSDEEP

    24576:hY92Cm1nKOsBgo0q4wMq3bObxR3SV4YM:hRroHMq3qG

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2