Extracted

• • Target
    sheet#4407465.email.exe
  • Size 450KB
  • SHA256 415ceff1ef1fa3bfc448613f3f6cc2435051f49ed8961b1cab030d75ee8bd65f
  • MD5 b68cf2131511dcebc3b6d73c977c4fef
  • SHA1 92aa85e866df8d9a131be6631e565324f77ee99d
  • SHA512 b57464af672451fe36b03e6a53c99ddb0f6cfd77bae1b875934ff1f1782c9b3e02a28da75253ddfc1caf72aa71c0fe9b9dfb5424f717590a6d49428e0fd8cc7b
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2