Extracted

• • Target

    fcf48a9792abfda9d9c9d32c6e7348e4cf3fed606c4aea8acf4e2ba4fdf08caf

  • Size

    661KB

  • MD5

    0415681a4ee854c710e55b9a0636c9c5

  • SHA1

    9b1794a146e7b677471f0f8a58080991b47821e8

  • SHA256

    fcf48a9792abfda9d9c9d32c6e7348e4cf3fed606c4aea8acf4e2ba4fdf08caf

  • SHA512

    cac4cae6223e0392b81d837b313c14ad1786b8b2f28c1ce3852bf81721c9d8ba8133d24b3100b07e41dd928fea58b17ebac67876497210646c90a10afd83a81a

  • SSDEEP

    12288:zEfpIjGy+YYUBYlIE6ZBBHcBh2PK8yxnwr/pTxXf5+wrDt1PB7WZ8:sVYnClI/ZB9ei/yxniJxPz3M

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2