Extracted

• • Target

    Document4757845845502135324062020_scanned from a xerox device0011.exe

  • Size

    463KB

  • MD5

    145e9a676c3c22314d3934137d4132cd

  • SHA1

    c2084db9f6186ec89fea7d387bad77d4d236e38f

  • SHA256

    585e690019421f6c49788efb03557062d871fb8a01a3bff5f1c20bd8227b19fb

  • SHA512

    8e2cb20246d27c8ea83a62c64cec830445f1b557672a140a610ce44157f16a1768d650abad8d6631fdd04d299c4b4a5c7ad2b7055cc025da35443c2683f83258

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2