Extracted

• • Target
    Packing List.exe
  • Size 470KB
  • SHA256 1d835ccaee0da78b01a8e8b1d738f195c8fc08ddcfa7da17223645a2bf47df04
  • MD5 109f44025e9798675d4b73a53f3c266e
  • SHA1 a5cd6ff71ac73831a8c0c65a98b6235f5148d9f2
  • SHA512 3339041b161635c74e797458cd806844797e08e7616069140eeec4c7c6c968c75fcfffded0db66a546ccdfec04e6ce69b6160cd5259292b9e07e571add5f5a5b
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2