Extracted

• • Target
    Tracking No_SINI0068206497.exe
  • Size 699KB
  • SHA256 7f511f157c4e3d413f1c71248bcf9abcc59edf12715db9e031270ae7acb0eb67
  • MD5 59fbd659300dd9df3b3b8846c99fc6b0
  • SHA1 35ac673d492ecd885837e4dfdccc5ad62aa94711
  • SHA512 eebc96d89c8304890a182135f3fd20ca996d5d5c384c9d6087408b4ee00fc972138c3af322c63e43c4f60b97fc888166387a01524841fc0e14a448f03e6ac795
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2