Extracted

• • Target

    fc70714dc470ad7fd4843cf74577a44be9608d0a998b06fd5b7735db31506755

  • Size

    1.6MB

  • MD5

    9d42463c2bc993f07b18d31f28f5f9a4

  • SHA1

    f28b5ac0e057a9fba11f550c96822de2210914e1

  • SHA256

    fc70714dc470ad7fd4843cf74577a44be9608d0a998b06fd5b7735db31506755

  • SHA512

    c037374f5bc71e2341c5e95be65ed8cac1c7dea51fbaf08ae3aeaa34a2364366cef08002b1ca41da3fe8f8a32de21567ab85a46e8ee8b57501086348d3ddae2a

  • SSDEEP

    24576:CXXd5fYXjQeUCHMwJ+pfCugv1RIAhjLoamMiX4lNmZg0YxegPbUIDPP:QN5fajQeU2d+d8jLoyEkmZ9Y14

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2