Extracted

• • Target
    MV AGRIA CALLING CHANGSHU AGENCY APPOINTMENT.exe
  • Size 497KB
  • SHA256 a58fc8e96f20e803cf01cffd2ca566ef4ec82ceca97f116aee211008f3f6a6e1
  • MD5 b2dab9f7ed4982d19dfb42ebe45715d7
  • SHA1 7ac2ecff44f0c9de031ed6f4cb1c85cea896baec
  • SHA512 2a442cbb680d4f40ecff613ae391821e3eda4add75baebeb661e621295ba874d8272fc82a3af81eeff2d3af1eb01bc76f6e4bcf52d753fdc9712e49acaf0e188
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2