Extracted

• • Target
    Documents.exe
  • Size 379KB
  • SHA256 9ffb2bb2203d01f3638f25d093aeefdb50211b3a3c00a8e4a561d58a01d71225
  • MD5 294d5de3d52d2d65ed7e267172ac2c74
  • SHA1 8df624b5343f3c69d26bcb1ea56f8276b37b50bb
  • SHA512 cef3c6ea2d0d014d1121a2c4472ea2d490c0e9c0da3ad68a980a0592ffc293a02e7681bb8d85ad282e8f63670180bada588dd3a753f540b640bd09db02297bcd
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2