Extracted

Extracted

• • Target
    BANK COPY.exe
  • Size 563KB
  • SHA256 3dd701e877f0f802984c90bcfdcde54c35780c9afb459b2d395e6d38b2d4a503
  • MD5 937717f0eb3d33bab9f444e54e6040b9
  • SHA1 d83195f4d3f42e84243bbbdc32e94c23982a2917
  • SHA512 6fd6809ad139aea7b94237b3530f02f8d3f98c227927be7a571c2058fc809c77769d206b633b3ec396b7238c43e884a06392f2a35ebe69bb6e04c87de494166b
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2