Extracted

• • Target
    GSO-1367-27072020112017.exe
  • Size 611KB
  • SHA256 8f93c794e02fbd006a5a7d2f929042819d7d5666ccb976ff248eef4dc6d2591e
  • MD5 2d04103bda6d755fd47c94d6773574c1
  • SHA1 41cc7cde2fff3f79a7124545e5a449bd42db4e14
  • SHA512 feb803979827b575b40b73710164cb2be368cf5800e253b1260f1afbf0eaf21b6dcb95456b1857ef7d4101dd6917a43362427bfe43765b242659958048c10e8d
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2