Extracted

• • Target
    SKM_C3350191107102300.exe
  • Size 521KB
  • SHA256 1631bd051bd9ef096e2cd29bba5c549e8b4028dc9de457c2bd5ee060c69a7e6a
  • MD5 3ecd7b16cf441354ab7c4bcea3971783
  • SHA1 17db333914cfeddabc5c7ab0b359d5ccebfe6f09
  • SHA512 16c820e26578c6e1b8adc7e3b64ccbb503ae0238d508e435ef6d9ddf118d496e55b16bf3179e890e474d4bbd7b3e327f33a971d2b642927d9a2e4e62f78bae80
  • MD5 SHA1 SHA512

  Score

  10^/10

  keyloggerstealerpersistencespywaretrojanagenttesla

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

    keyloggerstealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2