Extracted

• • Target

    a9f8962e8fe80bbe7b1462f0c4d776abeb968a6c8f33fca3074a54b45d09ad9a.exe

  • Size

    988KB

  • MD5

    bfeee0c844094e78262beb304526f216

  • SHA1

    844c0a9df056cc6690c90814158859e0fe728394

  • SHA256

    a9f8962e8fe80bbe7b1462f0c4d776abeb968a6c8f33fca3074a54b45d09ad9a

  • SHA512

    ad26d27557d7f8cfd7ddad346dabeb43e66ae9d87197728122bab0a71cda51d82489939d7ceeb9acbc15d41bcf9eb30cb4da7b353316fc9317bd25b8edeb42aa

  • SSDEEP

    24576:Hf0htH9iGnLexsKea/NfBe+STqRd3wtsyUUmoXg:HidcGnax+a/N5dKyoXg

  Score

  10^/10

  executionagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect packed .NET executables. Mostly AgentTeslaV4.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables packed with or use KoiVM

  • Detects executables referencing Windows vault credential objects. Observed in infostealers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Suspicious use of SetThreadContext

  behavioral1behavioral2