Extracted

• • Target

    3d6b5402645ee87ca702dc94288ec81d2dfc60e1834a17955754df218ed0bdf1

  • Size

    512KB

  • MD5

    ebaa0f93f29a81b6649b9de835c5b1c1

  • SHA1

    5c9d73b5e2789e2e225bd67909c1a4719c09de00

  • SHA256

    3d6b5402645ee87ca702dc94288ec81d2dfc60e1834a17955754df218ed0bdf1

  • SHA512

    232dd0d6ac85538a3fc418783f23f55b191a61604adba2cd47ff2c213a227ba5c7b1df1e7954412b67c3c8cbcb35299da1a156e1ca3b6602f998bad1767d1343

  • SSDEEP

    12288:ZwPUi2iN/UbvRATIeo6UYJ9io+eKIKZMUAr+V68JftjcAckLfv:WPUi1BULRAMeoHYni9fIeMFrD8JfvLfv

  Score

  10^/10

  agentteslacollectiondiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2