Extracted

• • Target

    4cdc4a2380f91ac7c463a157e3e4c5ce7711871de0af789c592d6e5d0ca68d26

  • Size

    1.3MB

  • MD5

    bf854d670f4375ec576fa03c72f724eb

  • SHA1

    89e6d464a771cb67b4ff6c17d5d850675e0ffa91

  • SHA256

    4cdc4a2380f91ac7c463a157e3e4c5ce7711871de0af789c592d6e5d0ca68d26

  • SHA512

    fd5b33b3c95568a9c70357da98a5bf24a5f0bf99f4e00a01242493907ae6e47f5d3473d73ae797c75396aa65f861dea9c826eb0dadcfc79f770c57578afe71da

  • SSDEEP

    24576:SuQFjpT6r96ixvI/Aj0/e60AYmv9v1RIAhjLoamMiX4lNmZg0YxegPbUIDPP:S5Z6R/I7/ymjLoyEkmZ9Y14

  Score

  10^/10

  agentteslacollectiondiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2