Extracted

• • Target
    455acb29d3223b12d434c016427c1c64.exe
  • Size 73KB
  • SHA256 c1fa48c0b9c81541dc2ba39db3fc1c410f6231e8df9aa69c02bdd1c8549b453a
  • MD5 455acb29d3223b12d434c016427c1c64
  • SHA1 ef7f24c15fc0b006f6f7c6da3854a94be50490eb
  • SHA512 ff90bb692248233871e1d9bc17307f194da0c4ba4280c907c85e349795ccaaa0778b6d9135f7d705879783dd120946ae87ff3442da04ca72a632882adfbff7c9
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2