Extracted

• • Target
    Scan docs.exe
  • Size 968KB
  • SHA256 a2a448693074e0f4af0170efc654357bbcd56eebc4176bbb7d40c8152578f9de
  • MD5 fb50b4a2fd3575dfb970aaa7ebb2709a
  • SHA1 1b8e48981a7a72fe6ad3497f17b1beb14bde16a5
  • SHA512 df96d59b8b2254eb97191523b2b18483f5ea68036beb773bb028018ad0492815a39a3cf57dd49875fb973cab0bd7e7af5940d18c2f23d8adefe0fe3aba51906e
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2