Extracted

• • Target
    58e919965df896c5650448556e2a6d96ecc92a8f2af4dbdf81f4a86c2df5a091
  • Size 55KB
  • SHA256 58e919965df896c5650448556e2a6d96ecc92a8f2af4dbdf81f4a86c2df5a091
  • MD5 f37cb24f77d71e5bae6018615ae6f789
  • SHA1 6e57ea1e47ffa5c0d51455be771602e35479f5d5
  • SHA512 1947086004669e9892227440df4e990cad1ccdd8cad5411db9b688c7d6cc7a005e484826b5d69c8b51996c31c11eee879b1c9a02a2b98a74175e24e80abe1911
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2