Extracted

• • Target
    DOC200820-20082020113622.p.exe
  • Size 639KB
  • SHA256 88734622195f09667ec17ecc61c3a1fe7dd63a930d45a22db92fe95cdf787af2
  • MD5 872a0a17f090c5f05d99a19ea9615cf2
  • SHA1 332eab2211619f35be75bb2bf4c8f72cdce4d068
  • SHA512 f6bc578d8cc33d75a504955634fb72a8757cb96eed43f4a656ff2aa427e72dea2f931a3860d4f6feb532ab518127722dcfb31b0e89e1bf7312a3b181977da88e
  • MD5 SHA1 SHA512

  Score

  10^/10

  keyloggerstealertrojanspywareagenttesla

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

    keyloggerstealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2