Extracted

Extracted

• • Target

    b764867253a7800f4b0a1ee1fbce93dc54e2e60a23b14b0ae1562af2042c53b8

  • Size

    1.9MB

  • MD5

    61067fc22c6628fe351a76f6ec19b6da

  • SHA1

    b1be7c51c75a5ddf4864f36bddd2cbb32ea6659c

  • SHA256

    b764867253a7800f4b0a1ee1fbce93dc54e2e60a23b14b0ae1562af2042c53b8

  • SHA512

    9891db373116baad04cbca1ef266f8e46ced5633f1eeb351c0517ea250d4d67925696481ee8602a9e8a77b5e30aa0939882e2c63e54688aba0c7713f06dd525a

  • SSDEEP

    49152:ah+ZkldoPKi2aNH5Bod+FNNnxv93Y6OqRkLDjH4ly:z2cPKiHB7NNn33YnV3Y

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Drops startup file

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2