Extracted

• • Target
    02bb1837b843f982b3a5c49aad515e10.exe
  • Size 574KB
  • SHA256 80f73360664b173a59e37be245fe1b791a61c74649e6a0f15ae5dc7fb984cfdc
  • MD5 02bb1837b843f982b3a5c49aad515e10
  • SHA1 fffd6fa55112ae2ad0de9d9043567fe7c20f3160
  • SHA512 ffaa0f09b1478c1e90dbae86c5caf2bc402bc3fa9edd599a8694a267d9620144aec65002b6f79523ff7320e1493fae392eebce43221b6ac40d4cf2be6792b1e7
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2