Extracted

• • Target
    da503a926b278a7fa77a3724e656fd70.exe
  • Size 489KB
  • SHA256 eeba7537e3916a6c6d52340f648f970c4ad8369052fbc235b5ce4e3f166c9aae
  • MD5 da503a926b278a7fa77a3724e656fd70
  • SHA1 9cf3ed0d69b5dbe38266d80a6c2ef5c33a02da6b
  • SHA512 f47d7680efd7096462244da799fa63fed5ea11d3756087d0d018550f53a6958874d79c538fefc5c72761847965b8f35757038d998fbcf31b63c98c92abcf5ca2
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2