Extracted

• • Target
    SecuriteInfo.com.Trojan.PackedNET.406.29853.5236
  • Size 675KB
  • SHA256 509d77d2bb2ae90f255bac13fe2ecee5a428956c1ce54873a9e89ae73878b306
  • MD5 0b46ddb51698e100f0e13c7ca1a783f7
  • SHA1 d8ce8676bd2b19742e9eef378c49eabf668c6a14
  • SHA512 c2d379f9bf3ce944ea51cfda8dcc00be0c7214b737a65d6c8363d26b78eaa78c8b1b37585a650655f86cf34eecedaf85f42c53e5363d9f2d06ecdd115445972e
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2