Extracted

• • Target

    4c2144b8a3ccbfcfa70ad01055325972

  • Size

    906KB

  • MD5

    4c2144b8a3ccbfcfa70ad01055325972

  • SHA1

    6c77beccfcc586d88694819b98e5cd269da744d3

  • SHA256

    149e5bfb4a5b094cbf9ace6afff4b288d35a14ee8691a607d1b94752b97d4710

  • SHA512

    01fce95f9e6cf783bbd95163937d5b536c111e94eb2efd3cc058a9d38d652bb0157f3710e744d4b0787dab1ff95544f7aa8fdeb2d7c9d415dfcfe5098e24cc93

  • SSDEEP

    12288:UiDc9F3nC0Py3gAhDINy2zlrh3zw0zdGhcpLl6kjz9JeXFrrUj6sM5HgR:UngEr1LdZ1jz9MXhdsM5Hg

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2