Extracted

• • Target
    IMG-678987655678987654567887656789-8765678.exe
  • Size 509KB
  • SHA256 2b5d96d018098da5990f2d6d721ab925efd4422c13cccf031775b6fddd5f801e
  • MD5 be4dbdfb0a004b96b82527bc72b9d66e
  • SHA1 98cbfd36cfe88184ea2ee17fdf119a507c7ca0e2
  • SHA512 42f195df5a7d926e4aefc66c544355fcb376be6f8cba77020f509d9ff0f330361b676db1c99029a1db438fd32290dd0910c9e070c8aa5d03b63b29ab98347184
  • MD5 SHA1 SHA512

  Score

  10^/10

  keyloggerstealerspywaretrojanagenttesla

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

    keyloggerstealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2