Extracted

• • Target

    1875ff6ba9beda4d257cdd4ef68d2e51ceb10acf2d15493d7362a29cc743c545.exe

  • Size

    670KB

  • MD5

    90867c0373fb279f9f2f5ed4c09cb614

  • SHA1

    f4061d8d89307006818bebf0de6964668df193d2

  • SHA256

    1875ff6ba9beda4d257cdd4ef68d2e51ceb10acf2d15493d7362a29cc743c545

  • SHA512

    995abe088287810a49168c75238dc2bfda604c640610c23ea535e0516a2606a11fe210732ea4ac661f90d6c7b653410593267c3b877fe01cd218c4578423d704

  • SSDEEP

    12288:TJ7Ci2F0DCuI5bBl6XJef6J665C+KqGUJM0Grtpoi4giJj/YwE56n:TJOis0DCPHl6sCI6k+KqrMPHJuJ8

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect packed .NET executables. Mostly AgentTeslaV4.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables referencing Windows vault credential objects. Observed in infostealers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Suspicious use of SetThreadContext

  behavioral1behavioral2