Extracted

Extracted

• • Target

    5b15cc1f3ac5f2e3f16e0446dbb9bbe9e9c0a44b76ce88f27dbcbc7455535b7a

  • Size

    602KB

  • MD5

    8bd60134a9e0d220a9aff4eae714edbf

  • SHA1

    c1465365bf51ad201cbabcb883834db55ce4d275

  • SHA256

    5b15cc1f3ac5f2e3f16e0446dbb9bbe9e9c0a44b76ce88f27dbcbc7455535b7a

  • SHA512

    d7904621d9ea02fa7fa18b3b22427f6e74811ea40a8e7274a843119625153976527b049c6d6c9aa7e745ec21bb47ff17c96958e6fcaad6da528296f8662409e5

  • SSDEEP

    12288:1QKPUitSRmxABR3Zz78E9Os5jGEvYOH/cVhP3k5g06+zz/iiq4bgp:1QKPZYWAvZzAI/Xeo5g06uz/Bq4bW

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2