Extracted

• • Target

    9e2aa1b6705cbb1121a9183bd9a75c1b674b9cdf26ae25318bcbc39bc3c7f715

  • Size

    666KB

  • MD5

    6cd4134a18f4ff72483a1e86bdc810e4

  • SHA1

    b28553b1bb0b9c88f122d818c5a725388036bb77

  • SHA256

    9e2aa1b6705cbb1121a9183bd9a75c1b674b9cdf26ae25318bcbc39bc3c7f715

  • SHA512

    6b9eec4276e6b64ea45b453b2fda82ccb12bd390804f8a02daba11719458a71f5fee56df68c2c272efe84ac2799fcf88f51b50287a496aed147cc15802902b86

  • SSDEEP

    12288:jseZfo/hXXj2C1vfDWHm0pbtz3HK9pINGPRrXLV08w/LMqfVfjE:pGBDWHmkz3H+aSRrbV08wYqfVbE

  Score

  10^/10

  agentteslacollectiondiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2