Extracted

• • Target
    HBL-BLCOPY.EXCELL.XLs.vr.exe
  • Size 546KB
  • SHA256 7198765cf784d75d7149e2253af7938eaf1598b960e65351bc0959633f503792
  • MD5 b3c3a754b3bc65c1c23f5aba0374cbc3
  • SHA1 1dd4140e0d4575cb9ad59ee97a93ea043bec499b
  • SHA512 301a86fb2c8a4320b1110abddb8e82956c29b8c55456000bacd4f005d346bd72686afc3fb449d13efddafc9c4667b5fa739c2b79d89c7023250d74117df2c833
  • MD5 SHA1 SHA512

  Score

  10^/10

  keyloggerstealerspywaretrojanagenttesla

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

    keyloggerstealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2