Extracted

Extracted

• • Target

    88c6f191134f95fe2819aa7cc6f689f89063fd1b1e2bbc4355835094eef56f3d.exe

  • Size

    626KB

  • MD5

    d967c1797f8f661121d4807c8adb2f73

  • SHA1

    4f56f7ad8d230ce34b100a0c44dd52490558512a

  • SHA256

    88c6f191134f95fe2819aa7cc6f689f89063fd1b1e2bbc4355835094eef56f3d

  • SHA512

    d6171c197c92c222ad7d9653012811621413a99e1f132f479675a11e0ade8b98d791c86a421d74d74ce7943eb586155df84a5934abc7ba97b5619474eaff072d

  • SSDEEP

    12288:CZG8L0alV10OoNonU93XDvrZ8YQtcIHikXRGZf+G6WejPHB778Qj:SL0aE2UbbNkXAZf+TWezB5

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2