Extracted

• • Target

    bfeea47f3d003859626e953eeede19f67a488eef7e2d0389a5c786f7963d01ad

  • Size

    482KB

  • MD5

    dc6c6772f48f2b3f996b77ab0bc29bbe

  • SHA1

    d605c1dc9c5bc4656b59e465142c1842fc66ec9d

  • SHA256

    bfeea47f3d003859626e953eeede19f67a488eef7e2d0389a5c786f7963d01ad

  • SHA512

    36ffda905d9c522a60c65f00a15bdbf3209b5b6b22a1377203d986c019740e7c25c812dd6650b48ad66c70edb2ba4273341a1b14cacfee08a4332e976574ffae

  • SSDEEP

    12288:vUi2iNf4iDBfgew83Kh+wcUJMIs1AX3qZ/gyQBzt:vUi1aiDaE6hUUJX92zUt

  Score

  10^/10

  agentteslacollectiondiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2