Extracted

• • Target
    MEDIFORM SA COMPANY PROFILE.exe
  • Size 569KB
  • SHA256 687bbb360426bced3a9f69df3a4ae321c30c2e6e8cc40bde6b6b7519a6aaab34
  • MD5 3a9f55174dde0ebbb90dbd76fd838fae
  • SHA1 5a4c43d3e639877e4da11de84a18db6bd8ed7a17
  • SHA512 a4310ad2a63ff1a60078ddacd86c809327bd1cfea3f0f68d00770d045458c1c117c4a02e322299b72108201bda5f50b6e5b35910a16c8fab0161731178023588
  • MD5 SHA1 SHA512

  Score

  10^/10

  keyloggerstealerpersistencespywaretrojanagenttesla

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

    keyloggerstealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2