Extracted

• • Target
    NANIWA ALG-40Q.exe
  • Size 572KB
  • SHA256 30e5d725ef8367f4d2d044ab45908659b7eda107d02452f6b30a87e4a6a49885
  • MD5 8fcc2ec6bb6b51bec97857b8ba2bdddd
  • SHA1 c53e31100be988c7962b0ea352f59902ebdef8eb
  • SHA512 98eb6c6e6a92de0cc89743ce0f59203f6a3f60c63b0d36a8a5d03e615deeb23220c1a887640ca5707452ebc1530aba40f33fb9269c095b4fc729c4695b685bd0
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2