Extracted

• • Target
    IAhYP4OuQ52pglH.exe
  • Size 620KB
  • SHA256 d00a0836ea91458d1521ee4ebeaab0746a45b10901497a215b0bd0ebdf045e61
  • MD5 33b370e37c963a7e3051a98a63429e4f
  • SHA1 92baae7d4da34c18807942cfb6c9f11906450d49
  • SHA512 898ae92ed64d30661a3884c8a4550ad7aee4515a2f9d0c3ee3d4404ac627f50ef888a4ba9d8c61df85c176faae014410e92f4f6c72679f69516eecfdc7664774
  • MD5 SHA1 SHA512

  Score

  10^/10

  keyloggerstealertrojanspywareagentteslapersistence

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

    keyloggerstealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Modifies service

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2