Extracted

Extracted

• • Target
    885b6003eb683aeccb927d2a9bc82b3c.exe
  • Size 543KB
  • SHA256 751dffc7391890afbcb40a55e29bd319d8b4a9e2e0438c5f5939ac09ab6ae297
  • MD5 885b6003eb683aeccb927d2a9bc82b3c
  • SHA1 c6d26dd4ae0edccd52a6afa7bb48239fb1f607b8
  • SHA512 2b03ef553cc2ac38d118346ab5a2f0f2abd49c06ade5b2fcfba95d10ebd77801bdb65fe53a2ceac281cccb3d83de4cc7f7d912cc6ca129b10412b19cfc603510
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2