Extracted

• • Target
    Document4757845845502135324062020_scanned from a xerox device0011.exe
  • Size 463KB
  • SHA256 585e690019421f6c49788efb03557062d871fb8a01a3bff5f1c20bd8227b19fb
  • MD5 145e9a676c3c22314d3934137d4132cd
  • SHA1 c2084db9f6186ec89fea7d387bad77d4d236e38f
  • SHA512 8e2cb20246d27c8ea83a62c64cec830445f1b557672a140a610ce44157f16a1768d650abad8d6631fdd04d299c4b4a5c7ad2b7055cc025da35443c2683f83258
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2