Extracted

• • Target

    92c7e69b6d03a37ec81009ef279a87ef62d8fa6b8d4122a005813facbed979f5

  • Size

    492KB

  • MD5

    3264ed302538a2d29f2e48f26eff85b0

  • SHA1

    45a77b6cf9772caa5867a76c9f1d66c2ee40d10a

  • SHA256

    92c7e69b6d03a37ec81009ef279a87ef62d8fa6b8d4122a005813facbed979f5

  • SHA512

    f73672146ddc183532b48dc66c449add85a84b5e9fb6e9dddefd17d05f56d23d40e459f3a52fd571c68add81d0c0264c21399ee4049f64102c04ccb1d976319c

  • SSDEEP

    12288:oYtgJpASCb8O7g2b88suVYx8ftvnt/TDq2IN1SJrx:oYerASsckVtFnTL

  Score

  10^/10

  agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Loads dropped DLL

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2