Extracted

• • Target
    ce76e25ac5c9b3f431829b0c7e79f2f6.exe
  • Size 847KB
  • SHA256 4c2e0930bdf8d7e4f74a6b005ce1a1fdf1fe3a77ea4b1b88d7ec4ec4d9d9655e
  • MD5 ce76e25ac5c9b3f431829b0c7e79f2f6
  • SHA1 348da3c73bfb8a2ba95f79e3248f6f5d66344a30
  • SHA512 cf3645f293a771f32dff94a7defb069d771ef29afca5c0779df539d06bf7f2c8c4157ac0f6deb3496ecf81d913ce1d03af624f80ec9bbb4425fb376ac264356f
  • MD5 SHA1 SHA512

  Score

  10^/10

  upxkeyloggerstealertrojanspywareagentteslapersistence

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

    keyloggerstealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2