Extracted

• • Target
    img-602105445-0001.exe
  • Size 1.0MB
  • SHA256 f1044b4d40e2d3df5e586d5c8c58e49fa4795eed6b6afb44b506efe4319f4d0c
  • MD5 d934ca5e00cc636794638d7aa4b7539e
  • SHA1 0a16fa29a67e33cce6a6eea89e57f303edf8f44d
  • SHA512 966f5b25daf21cc9363c6114b00f54d18e92e6a2724048d3e671bf4e1787338fa0e4a2690f79503c8e0a32cf06fc7e3b19c60ac5afd857304555de8bbc717366
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2