Extracted

• • Target

    1ce3c7ed002e94792d675475ceb4cf48

  • Size

    892KB

  • MD5

    1ce3c7ed002e94792d675475ceb4cf48

  • SHA1

    a42f0ccdd803cb7b4a8ea05e46e7c012d7fe06f7

  • SHA256

    f429388fb11aa0067f6e5927aaec48dd9d6c4c22893182961a7c6e5cc3648a79

  • SHA512

    f4114a8141396c90822ed7488f8415beff3066afc4d0a6d7cf6df7d05d4e9195e091f45f24117efd0e7b9157889332cde972327b2a3175b6fb16aa526efd9881

  • SSDEEP

    12288:UoMg9qlXpkRAkD0zsLrQmkc1DF2s6bogj4ydZlNBCfhWMN5fNnxKlfDb7b0wNZ9E:UoIoAg/LrQacs6boG4Wlv2W0NxKl7z0

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2