Extracted

• • Target
    MV MOUNT AUSTIN.exe
  • Size 1.0MB
  • SHA256 b8378f3853a3fbb5a5e7cdd2fd81ac767f8798ef68951b75adb1fa6c13a34cf4
  • MD5 87f50fca79852562daf428fd14324f4e
  • SHA1 ccfb27760ec2376f68b6c7b5da07de933af6e76b
  • SHA512 e850cb88b9886db743b8e0004ce39195d6775d7eefeea1ca0c1e20efc72a1cbc5b09ded3b2f0a52f9706892a199c0f6e42bd3575c25fedc7760307fcbd4c1b42
  • MD5 SHA1 SHA512

  Score

  10^/10

  keyloggerstealerspywaretrojanagentteslapersistence

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

    keyloggerstealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2