Extracted

Extracted

• • Target

    751597396e020f0bc9c02049fba72290571f6ade9b2c079f33bf1e70f99a30f6

  • Size

    618KB

  • MD5

    89a59e73c237d1481548d88515394670

  • SHA1

    f15a5ec1eede4b6775a63437b1b6680e22114ea1

  • SHA256

    751597396e020f0bc9c02049fba72290571f6ade9b2c079f33bf1e70f99a30f6

  • SHA512

    4f42b8f1def1b1933422228f26ca7a956f081a432ac1f506ef1a117386851ff1526e6e01e3b998ada010cff0445d9c4fde9324a750f9f271712d7fff5c849543

  • SSDEEP

    12288:7mJgA6dpf4hbwI1ZuIWaa4Dw7OcZtiyQmeeDDRjBCK6iWpWUv2fL:CaLdShv1wIWaaJVvivm/BChiWpWE2

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojankinsingloader

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Kinsing

    Kinsing is a loader written in Golang.

    loaderkinsing

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2