Extracted

Extracted

• • Target

    ejima cripted.exe

  • Size

    461KB

  • MD5

    dfcc57d89ca61c9329bb0add87565fbb

  • SHA1

    86b63c28ba26f00ea34ce2e30c310b065767f854

  • SHA256

    0a13ba6b394ff6c4792edab2d8ee52651fa9ecfe014059b951d28d2f4383f101

  • SHA512

    5ce440dca5e9f2772971ac8da6bf81e04489f2683dcd62416d4ab56d653f5b6678a7fb8fc16b7ba7a890de51f45fc05dd2374fc12c084931bfa2da730c00f2a6

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2