Extracted

• • Target
    ca033e0eb65ae1baf1920e276478bc8d.exe
  • Size 670KB
  • SHA256 027a94f959321d9125fb092ce081b0fbc108a9f3b2300a9c6cc8227a9109f13f
  • MD5 ca033e0eb65ae1baf1920e276478bc8d
  • SHA1 43da4af4b599298bca0f94ea636269055e433041
  • SHA512 f43587199a3b8ae6afa730f1851f51e581397eae61bc06f6abe05bed7d9a2e89d2202c18427edfc3106be365cf2826f229ebe8b1029cc9f7963d168017898677
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2