Extracted

• • Target
    Bank Receipt.exe
  • Size 697KB
  • SHA256 82111ffe99296ab2292bfc56a031ae1daf701520ead377ee34e4a72f31c75285
  • MD5 22e1590bb7500dd34e74dec3ee590707
  • SHA1 fadda3cfd23ccff08cfbdaa015d69ed11f8e766f
  • SHA512 2822560133159e991fe1d6c1f3ea0410f5193cf22639360a0c29406d56a66a2ca0ac1e7db34090c43e9b4b67a3d30a52b3d9a843ded17bb0708f81fc0d21bd9f
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2