Extracted

Extracted

• • Target
    HMc97qN16UxqYk8.exe
  • Size 911KB
  • SHA256 48f8e8504e89f98adb7acc7f938cb133b7d17a4acacdf1bf36dcc02abe51e87e
  • MD5 243c5762b51da1445a81840631d7d75c
  • SHA1 b5c962508328353a7221c24b2295a6f137fbf6d8
  • SHA512 acc044fb9d35158ed9b747795388b7ae79ecbb82444113f7267db61bbac26c5101203dd225e636ad89332c48b5fc5a79bcd0739ef2fded490ef3d756f33be12d
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2