Extracted

• • Target

    e7e5fbeb7606fdcdb246a9df4efaf2896a82cd335babded9231dd990a110628f

  • Size

    649KB

  • MD5

    6fe36f5cd0c522ca1241658ec2553db3

  • SHA1

    f197615adff4daace92fd2f0c4f266a6170aa464

  • SHA256

    e7e5fbeb7606fdcdb246a9df4efaf2896a82cd335babded9231dd990a110628f

  • SHA512

    2b288eab811c12a818d089d419b8e51ee0b3692274010303f968fae82dde99a82c8601621860222c3b365f64fcc6508310e51cf3a954414054822d293d39196b

  • SSDEEP

    12288:BY0bffsWYCGpoTt4wT3eFjtyiyCgchaxpvQfSgYE:BY0zjqgt/T38jty8hs4fPYE

  Score

  10^/10

  discoveryagentteslacredential_accesskeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Loads dropped DLL

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2