Extracted

Extracted

• • Target
    pronewcryptagain.exe
  • Size 721KB
  • SHA256 8eb3933e2012364a81fa9f1003c485c03c6cafd61eefaf1b4059cc8d4a4066a7
  • MD5 a4d851f38893d81253064f87250c4e2e
  • SHA1 1fa7dc7a8be6844201c71a4562dd8c86515b0fc7
  • SHA512 ef6d3a375d10e30c0e2bf7180a7044aacf22c789dedb4fcb61c01dc953a04bfd62487c3bd19779ad0a0d46519d497add7c1c1693095c551ccb6cb00a054d7a07
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2