Extracted

• • Target

    cccf56cf62f12bc1c8faf8e8ad2b490b55f776fe87512ba3f0f2b826a311942f

  • Size

    411KB

  • MD5

    7216391dd45c08cebb4d4958b204777e

  • SHA1

    5e1c1878b778c874de378c172119d9ac758c7c2c

  • SHA256

    cccf56cf62f12bc1c8faf8e8ad2b490b55f776fe87512ba3f0f2b826a311942f

  • SHA512

    d03e40422640adfeac54d581a87902fa234d85a6a54ac6a138ca0932e54b9f92072ab1d6339e6f2239ac91d052f35f178c8782445c94773ae4a0a50abfe049a6

  • SSDEEP

    12288:ORRcY9GXndIQPTaFfbEMcA5ZxR7bQTh8:IRq72dDL7HbQC

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2