Extracted

• • Target

    0805f0cfb915df921fceebff50ff549de99099d743f0caabfdd6d1dc49eee010

  • Size

    447KB

  • MD5

    e94788f83a6d3866fd9556063fa989d3

  • SHA1

    8b51cf0d43398850bb224ebfb73feb6e0a6ea867

  • SHA256

    0805f0cfb915df921fceebff50ff549de99099d743f0caabfdd6d1dc49eee010

  • SHA512

    b8bef6c09b3896222aaf49d2631ea8b5740a6d116360984564bccb9a4dc8da4ec5fab4233ddc3527d5f5d6c886161ffec5f43bc4015833e845d06ba21b94e6bf

  • SSDEEP

    6144:G3kJbU1JhQdf/65DMXqCFdxTRHDiK4KhrR+gAj3dDpS3GsLl4hHJjvYX:IebU1/oKHIdxTNV7b+gAjNDk3ziJjwX

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2