Extracted

• • Target
    COSU 6270575380 PCL2004868048.exe
  • Size 606KB
  • SHA256 b4b4e82b4584a55722d213ea607a3b1131caaa039589a27e12ba4feeeaee7fb5
  • MD5 d1d433ad7fe5db077cb81ef0e4ec4e60
  • SHA1 d94a577faa1557bef7fd9d2eecf7386ec3ea7e88
  • SHA512 b1dbb723d3a342ef6666a9d11cca5182bc2228c146f2d6912eac3ea337bc1bb9b9ab55a11c1a95bf9a5bc834c41870d8b3fb2d5baafc99106289eb3c2a2b0c4c
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2