Extracted

• • Target
    a1a736c61171b260694ee8248a5dbdb1.exe
  • Size 669KB
  • SHA256 9007d5c1eecef73c5cef31b64da68425f7930e96ef519d2c5a7ebb59236b32e2
  • MD5 a1a736c61171b260694ee8248a5dbdb1
  • SHA1 e5a8df586be7098df4dab1bf96b3fe53fcf7b4bb
  • SHA512 a2337561ffdf2dce8246ea29b6bda77f522fd542f6186c4d7855caaf76c9f2cde2509f4c1c5799fabbf854bff240cd86daad1dfd2264548389f912ec084f37fe
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2