Extracted

• • Target
    167492-13243-13-img.exe
  • Size 618KB
  • SHA256 c40de93b6a12855b8fe84ab03b11e849bf536cb3efa20bcc544b71998429bede
  • MD5 3c8fc16a90de20c5e9cc8ddb4d4fe301
  • SHA1 dc2767ea50753660e492f1ff52a0c07141c0123b
  • SHA512 b49cdc2e2733f72499d48f3c07a115204c120df64d4605f4deb285748e7d5900759c94a2122d913e50c8bc22fb1217cadf496d49ec89100e339eca1267ea3363
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2