Extracted

• • Target

    3f8fa6737657f09e1c255549c1f370903ea53a40e79518e1f483acd798ccd8b4

  • Size

    1.6MB

  • MD5

    04ce0ad4617420d4fc0f2aa5a359c610

  • SHA1

    fdaabb7ed71db348e30844efd0e05032deead7ab

  • SHA256

    3f8fa6737657f09e1c255549c1f370903ea53a40e79518e1f483acd798ccd8b4

  • SHA512

    b42b96f6297fbd3c2e7ee3aee227561f858f0827666a8379ffc1ebef6e48764d31822b69ed2240559e89043ca3167412644bbac2b11187073aacbb9756861627

  • SSDEEP

    24576:rYD24how+nCxz27C0jZAIKo3hOKU8MSn3/G1CS+tBXSdIUpHKE4PhyVw:s2xw+667C0jO1GtBg7lKE4PYS

  Score

  10^/10

  agentteslacollectiondiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2