Extracted

Extracted

• • Target

    ejinewcrypt.exe

  • Size

    713KB

  • MD5

    13c7191ab2781a2d225665a4c1b23b17

  • SHA1

    89d584fa1b31d8fc00c35fe73de89058dd79ec2c

  • SHA256

    50e017de70cd0bbf71b8f4e687d56b796cd355b38c30076c7769d8b0b8562449

  • SHA512

    96541683f67c11f33ce7f3c8674c84ef866c7c71558fab546a6c98662b59e1f012d36bfcec510897cb8d618ad74bb46489ba77f397e07ad6a952971be0df95d3

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2