Extracted

Extracted

• • Target

    0317000459585_022024.exe

  • Size

    817KB

  • MD5

    5e47db10ac3db0dd3a65dde176e9ae83

  • SHA1

    3f59e2d35f9a78391c882cd19e6fd9e685bea9a3

  • SHA256

    fc8a9c0e62e7e7df74d0d59bed35d720aca7a47021f8c55bc1bcc32fb3075a94

  • SHA512

    a05e830a1126051ff598f0fd58bc044027621e800777c405536bcb4fd58af5fb6cf87c7a007105f84fa7bd615f05ada00359bfdc821bb497b0e49fa150e45470

  • SSDEEP

    12288:ZCsLTMGHwgG3SXW+Ch4EooWHPAitfwwrmQcoyifFicgXvSvbTz89KlDD9D8UXYxe:foSEh4BdfVrm7uj5vDDGRw

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2