Extracted

• • Target

    2523bc51a434b45d9fa9881a77340fb7

  • Size

    434KB

  • MD5

    2523bc51a434b45d9fa9881a77340fb7

  • SHA1

    5cc3f91c0ecae0f5bccd83d32636decb3c849840

  • SHA256

    816dcb90b3a0ca7d6dcecf4b65a1c999875ce0f1f9fdf1e366a75a4fa5961aa6

  • SHA512

    12ced3cdd42fbcba9f419739938637adb4ae94ae658370aea509c94fe7e4e77b9063f5ab436dae9ec5defbb7fe6e451956a676ce290e39107ac357be3875e939

  • SSDEEP

    6144:qLvDHBxZUvHoefKvbFFx15uOLykoFeUl/Psnl/s7xnqHLw/QgisQjB:QGIeS5zTuOL4essl/s9qHngisQd

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2