Extracted

• • Target
    SecuriteInfo.com.BehavesLike.Win32.Generic.jc.10253
  • Size 667KB
  • SHA256 3fdeeff9063421be07d09d4e1af9d7051e036ca556749cd82aaf6335593f7dc9
  • MD5 90d8f998c54b888fd95f66c2d7e869af
  • SHA1 682afda12a857b59b38b1b64de9c2e8ca2d630a3
  • SHA512 255941f16c99a67cc402031af3c5b845e01f6204a23ec405e4a8a2e9db9b7a03692f136573e9176f0c04e11a5699f355b1b67b151b70b7dfd9f983b6e89b9aad
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2