Extracted

• • Target
    Image001.exe
  • Size 1.7MB
  • SHA256 3b14e1d76426cce9efbb31dc83050a145a304e91c1089a2f51f2fda8c9bb0c7d
  • MD5 6f89019384487c21dbed9bc84a2d2891
  • SHA1 434fac95bd9a11ec481ec0cc45ca31f9e279a596
  • SHA512 a5e36f60f57b2dd8878fc40d6978a449b3511f0ab8df9cd8028e1ce13555c446857a50fcdd24730e632465934abf4cb176a998c5ea2fe172f203d051c58901ae
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2