Extracted

• • Target
    Scan docs.exe
  • Size 1.0MB
  • SHA256 71d8159ce550c2d8526d40a569f7c3cea6da7107208d80d8ccb15cdbda64603a
  • MD5 43610617c1be60cdcb9cb1a9812e27b9
  • SHA1 10b7304ae58e93821994d0bf09c5727d8d3ba486
  • SHA512 68df72aae61c3b0def02d7faae199842c8906ee3918621e68a26a36294df8d824d1cc96cd818e6455f7fe8cae483b1b018b81f639c20008ef4d52c4fa0d1d342
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2