Extracted

• • Target
    finish.exe
  • Size 824KB
  • SHA256 3da7c55aab706ac053ca313cc24d065983e8eaed5172366e93fdf8b2d644f829
  • MD5 59f804406a29fa425b45b1dbdfff4940
  • SHA1 4db7419169ae087c152c656f34ba2ea8ff28c922
  • SHA512 f02587b5936cf081e02eccad3161ac58e70497aaa4be895e480df5676403b7c62144cd79f64cf42be5b054e278cd6405516ce9e8eb0a2e311b89ee6c918d3fad
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2