Extracted

• • Target

    f00c052cc23443ce5dc784a160e45ad3cc15a4013429348bb84752132139c753

  • Size

    815KB

  • MD5

    b50f88d342ef3da5e5e61f0d4905c901

  • SHA1

    68d911aebf911924c04217310ebf520fe655b913

  • SHA256

    f00c052cc23443ce5dc784a160e45ad3cc15a4013429348bb84752132139c753

  • SHA512

    72711a9466b7201d8bc5684ecdbda0da501c531df41facbeaff1e61475597e5ed40f2bce739cb0afa30d8153e5d1e14d9a75686bfaa7ad1c865c8984680c4d08

  • SSDEEP

    12288:MgHD/DJGWTLLGlgD2dvbxzHbhV91HF7scQBN2BLBAiiU99ZwRyb3c9J:Mgj/DDLVDmbxzHJ7sDEIU3ZSyT

  Score

  10^/10

  agentteslacollectiondiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2