Extracted

• • Target
    oW0OiFVLFfnNTMw.exe
  • Size 499KB
  • SHA256 a7534a67287f201714e7983107df187fc9b9fee458ff257d69dd312e17f8fd6d
  • MD5 68e46864a1efc4e561da7066af5622d9
  • SHA1 7b1e6b7ec715baf9b55c75e41c6a978af8479fde
  • SHA512 68e985aceca4473868135ff913f77663aa09d32d4f1c78f96c8912a34cc404ce57533a612b7bf0828c282a7f57dfd6f2ad067d1003267abb9bcd742a018d6267
  • MD5 SHA1 SHA512

  Score

  10^/10

  keyloggertrojanstealerspywareagentteslapersistence

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run entry to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2