Extracted

• • Target
    8f52711815407baaddec35fd9cf56358.exe
  • Size 474KB
  • SHA256 c83d1de6588bfc8fde4db24a20f2cdcbecd2917faf45e5f3327fccd01e80b953
  • MD5 8f52711815407baaddec35fd9cf56358
  • SHA1 fe47621154212ae7214adb70d3f5bc5e51afdc11
  • SHA512 9471034dec6f219085158bf0af9bf101838ba8a304fd0ccc135d3a971790e4238dd74ac43ebbf7295d81c53bb9fe1e966e5b80f14d481016e87e60f9868c05ed
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2