Extracted

• • Target

    dd95f4d49c991f595630b62f2f2472b194933a7492483b08aba3ae8dab0d0017.exe

  • Size

    985KB

  • MD5

    41e2c9be707b6b639c5e1c0a5084d9c0

  • SHA1

    e063e6b3f27daa1ff6696debc9d03072f9659f5f

  • SHA256

    dd95f4d49c991f595630b62f2f2472b194933a7492483b08aba3ae8dab0d0017

  • SHA512

    f2cb31a84beb99c41a63c76ae55c6b71e0b3e73696e62baf9c26cd8bd93b2f807fe1f34af773a7788e6c81254ed53fc22eb970237239bafd1715792fde26baa2

  • SSDEEP

    24576:H32/9s2+WjIYlmbHxhSX/AUQbdh75r1k:Hm1BsdHkAUQ7F1k

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect packed .NET executables. Mostly AgentTeslaV4.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables referencing Windows vault credential objects. Observed in infostealers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Suspicious use of SetThreadContext

  behavioral1behavioral2