Extracted

• • Target

    d9b50e6caaea2686b421cc5380b6bb3c67515f222f377d2b093352abdfdba47a

  • Size

    667KB

  • MD5

    6370785ab7838f283caeb2abf4a67d99

  • SHA1

    462f26fca7db24c67a71b99dc21aca90fde8bd6d

  • SHA256

    d9b50e6caaea2686b421cc5380b6bb3c67515f222f377d2b093352abdfdba47a

  • SHA512

    21fe915e5d7344c1df60e7d6d6bf3ceb64d021722940a1fd0d4300ca64d622fabe1d2cad38712daa87a52b4a281b9abde84867732c4bfec7f91ea07cc3980f85

  • SSDEEP

    12288:rhtGBPQAaPr/oRUcOlF+H+1/mHRE4pOe6X8g/hZJrTxYWGtTjipgfq+KYwX8:lXLo/OOHeuHREayXf/hNYr7KhX8

  Score

  10^/10

  agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2