Extracted

Extracted

• • Target

    d91abe1f2c3533430178d0067ffc5ce588d2bd241375179829179c82d39d9e6d.exe

  • Size

    1.4MB

  • MD5

    726c360beafc5735df3048301fccc5b9

  • SHA1

    3b9c9c07bfd564ddad935778a24e2c93f8883457

  • SHA256

    d91abe1f2c3533430178d0067ffc5ce588d2bd241375179829179c82d39d9e6d

  • SHA512

    cac48ab2f722d845bba623f80dcd0856b651e3ec46695dc4efa4f7cbd94d8d877d581001b6d32d14f16628787636537753c418dc27d27e07a5ad2ae6d3c8b9fa

  • SSDEEP

    24576:8yLNKjUF+x7f5H6s5K+zzLZYaQer4C/RYhhlBk+hIHDSYWORpHc3gpJ:m8IzLZ9Q04lLOD5WORpkgpJ

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect packed .NET executables. Mostly AgentTeslaV4.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables packed with or use KoiVM

  • Detects executables referencing Windows vault credential objects. Observed in infostealers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Suspicious use of SetThreadContext

  behavioral1behavioral2