Extracted

• • Target

    QT00342020.exe

  • Size

    526KB

  • MD5

    b60c3fe07b3d9b5c85124c55cc02bdc1

  • SHA1

    b81c02952854453629491b31ad3740527ff64595

  • SHA256

    3753be46dda5f897bfbe00944241e5b7b11d77bd0e0a919ca3a751354faf6319

  • SHA512

    e3297bd3b7868dd6cbfa6be6feeb7eeb82c54f24460f5f5aa86fa49e44be149dce3a2c427625fca66bcdb4ef225b0d9877c3ab4baea7665b9a0d19e97a4b0b46

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2