Extracted

Extracted

• • Target
    708be0d87c2de77618729c3c886e1d51.exe
  • Size 790KB
  • SHA256 431d5ac94ffcc12e9ff48e227ba286736ba47a50e6afd8f1ac2d9bf4a1b9fd33
  • MD5 708be0d87c2de77618729c3c886e1d51
  • SHA1 68b7939873e7aba3112e6b51a3cfd2b8b43a2749
  • SHA512 45b17cc1c6a2b79853a3907dd32e0ae2967ece57f801b7897547f04ac2179e82582479c9916822c44b9f45a7015f62e05fd38c00dde0b5f11b01d00787fda800
  • SSDEEP 24576:ie01vNe4sKsFWhjcn5vH2CQzagk1bMOn3qfjt1Q:iGaVhI56Ogk5Habt6
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2