Extracted

• • Target
    A504959.exe
  • Size 790KB
  • SHA256 a99afad6c2f267c22062cf92c8996cdcbf175baf5cab453ce8aae27c43c2ad10
  • MD5 b92d4c6e2034bfe35b729def534bc5d2
  • SHA1 e34c21c9e409b83600e5acb8cc5dba4eb046e697
  • SHA512 7196a1bb5e9d3b3ff51ce6fd0dfedc6e58a75be6b61f8d41407b2f579330c9acebb05d0b9fe3c05b1637fe545f1a6e7274c9d84e11475eb2930ac26196a1ced8
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2