Extracted

• • Target

    be7ab8f013de3c96bfb0240a4ec6db202222cbc9dadfab1dbb0679143a28b118

  • Size

    1.1MB

  • MD5

    c264cd1ef3f3e4af36fa06f4228f6682

  • SHA1

    b59018f6e755a80161a8547e0f3cf258cd8051bd

  • SHA256

    be7ab8f013de3c96bfb0240a4ec6db202222cbc9dadfab1dbb0679143a28b118

  • SHA512

    20e676f825f5e939660831b8398c35a07a758e9c9bc1f1d0ef9844cf9f63846f88eb544f4ecc0bab1e594555fd9ab81de9fc20e607dd6c6d4f7bc2dddfe0aba8

  • SSDEEP

    24576:rO2j8/LL5X8jGW8Ii+oAZbY0xplJaHYTVQZPPIF:C2j8PgBxoAS0BJIw2P

  Score

  10^/10

  agentteslacollectiondiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2