Extracted

• • Target
    SWIFT OF T.T.exe
  • Size 1.2MB
  • SHA256 a34c112bf95fe938efd100c5a3a2653153a69f7dc8dcc00876087b8d0e56e285
  • MD5 ae5248891b0242dfe1b25ba204b7467f
  • SHA1 59f3218709ffd93aa449c946951df681d3ae2c38
  • SHA512 2203c33fff46163eeea4a848f8541d896f8bfcc1537b7037d4e3616333bab513dd8df120a01bfa4f69623278b06aebdcc04b3808e9c39bf728bdb0c2d1444496
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2