Extracted

• • Target
    665818cbfe17ca18822c19203f22abf5.exe
  • Size 726KB
  • SHA256 ccc3b2be409e5a8b8166f6ff51feb068ba05c6dfb4e31fd34e8a853970bd3a40
  • MD5 665818cbfe17ca18822c19203f22abf5
  • SHA1 e6282fabd3664f04d81d585de187d454a299c1df
  • SHA512 bf21b856322f85f3c9c41376fa852f62ff496a68cfee0ceea983714dfd7cbbae837ccd1f380a8b04cc4562b44fbcac3890ae2d0ca761205e24e643e534861aac
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2