Extracted

Extracted

• • Target
    6bdf803d22cfdff13e317894ddbec9076aa67d85422414ee7d12a1d44c6b0fc1.exe
  • Size 861KB
  • SHA256 6bdf803d22cfdff13e317894ddbec9076aa67d85422414ee7d12a1d44c6b0fc1
  • MD5 f28a71be9ac5fef241ca006196e9607d
  • SHA1 6fa960df9570e3b009e783f7c628087f26425591
  • SHA512 25f56245397f8ef0f5a27e740ddf991e7e066d462959eefb9a5f85c6c75df5fef2ec3de1d27be0e31e39f658e48e71c4c1fa4796747c13d46249ef2c2423ee12
  • SSDEEP 12288:86S8Ei6SZzpX8zmhVl1/l1b9saLgg0wbGAHRLX9B8XcjZwVCElHuP:L5EhKX8SbhTpptVH6MFGHu
  • TLSH
    T10F15E04022ABDC13E07657B005E2D33447F52E95E622D3478FE6AEE77A26BC129C0793
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2