Extracted

Extracted

• • Target

    885b6003eb683aeccb927d2a9bc82b3c.exe

  • Size

    543KB

  • MD5

    885b6003eb683aeccb927d2a9bc82b3c

  • SHA1

    c6d26dd4ae0edccd52a6afa7bb48239fb1f607b8

  • SHA256

    751dffc7391890afbcb40a55e29bd319d8b4a9e2e0438c5f5939ac09ab6ae297

  • SHA512

    2b03ef553cc2ac38d118346ab5a2f0f2abd49c06ade5b2fcfba95d10ebd77801bdb65fe53a2ceac281cccb3d83de4cc7f7d912cc6ca129b10412b19cfc603510

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2