Extracted

• • Target

    AWB 673687387678.exe

  • Size

    419KB

  • MD5

    42a1bf57e59510b27b6128f1edc76fa7

  • SHA1

    612f8808225a78dab158eeab15fcc1a9635ecb70

  • SHA256

    2409f04509b447f04121091d6b20dde5291413f155de031ef7e306c736ed9242

  • SHA512

    504f1c1461a40f7e3cdc4fcad8cca3f25e991edceefb2021b7c028a1d664284275c40a7d86b32e03c97d3d9ecb56cc0d72e9c9d5826c938ec111788e0426f3f9

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2