Extracted

• • Target
    2ACDnBfZL2HJ5cA.exe
  • Size 447KB
  • SHA256 264bd7f956bd27f6a62e1c4186af9b7bf6be96aa4ed73e8702ab978a85d1ff05
  • MD5 85a9f3f3534ead6c9b28d2f7eaa46fdf
  • SHA1 225216a2d945b33f4bfdce3c9ef0af13fa309174
  • SHA512 2cbd0a646b35f1a42dbbd6d2a95653eca5fb1097e1971a055472aa991beceee4c6ba0e502ef0bf29e2cb23beec848af961d00e18ad1581406b5a81cb15ce86cb
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2