Extracted

• • Target
    SecuriteInfo.com.Trojan.GenericKD.34164005.15307.19397
  • Size 722KB
  • SHA256 9b7b121dfaa8fe9005cebcc4fbface3382e339b8e05eb29e2e6aa37c419ed81b
  • MD5 0bb3bf0a178fcc963a51ee4f39ecb20d
  • SHA1 f214c9690911dbbbb34e561b543ca4570484f4ae
  • SHA512 2ffa8c6aa88867bd0137ae9e83777b7e07b35b4414705aeaffdee6e55e0c802ef37c0d6c9e55c7c538e02c25e289041f99648c6ed4f8831fb71f8890524c2183
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2