Extracted

• • Target

    e22765977cf0e9bbb934c09c7d6be2588fccb7284c4329ef9246bc871791bc3f.exe

  • Size

    432KB

  • MD5

    424a08839a7ff51bda293ad1dd9157a9

  • SHA1

    dc664d7059bf1189bbea15452106e174f12ee7df

  • SHA256

    e22765977cf0e9bbb934c09c7d6be2588fccb7284c4329ef9246bc871791bc3f

  • SHA512

    29847e172124240ef02e9567191f1dce6c82a7b4164d428ee5a4d73636e2c1d2481d52cc5574f31e868a16105e7d07a82100246624a3ed428e63720ceda518a0

  • SSDEEP

    12288:QhH0iucMgeYKUJoR0laATYJPzMtzjP26GEcxC:QNdVAYRJk0LTMgtzD26Ks

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2