Extracted

• • Target

    837c9f462983fee07c9648d487f7ff5e1ec82c9b45d0ae9337f8c452cd0e6b5c.exe

  • Size

    650KB

  • MD5

    a054288c62a8c96b4393e0d7616a3d6b

  • SHA1

    79cb13055b7831afc39dd91ec5b32205b962b2e8

  • SHA256

    837c9f462983fee07c9648d487f7ff5e1ec82c9b45d0ae9337f8c452cd0e6b5c

  • SHA512

    d01d8a717ce768a2de35a9e40e568d084bb4f0472eab9e2975ed6d161c0a276804e15f219d3deb1cca5fe341541e57cc17395d45dc28a16eed47c7c31d993e63

  • SSDEEP

    12288:EaAv6zT370OC2qoICt4VhTYFGf4KGrV0nQQCqqWLz1HL9wtT5wjBMOioRw4RjR90:6PlsMTYF+ZnwWR9wtT5wjlwwP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect packed .NET executables. Mostly AgentTeslaV4.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables packed with SmartAssembly

  • Detects executables referencing Windows vault credential objects. Observed in infostealers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Suspicious use of SetThreadContext

  behavioral1behavioral2