Extracted

• • Target
    efs-specialist.scr
  • Size 746KB
  • SHA256 f939baf20921d0b9ed165d3339a3a316628ffe4907e73a7f99fb2b0d8e246928
  • MD5 29b6f7d8b57b9189e55cd2de7a7ac44f
  • SHA1 7ad15d659b1028276793e3986e3bbf803ee73806
  • SHA512 edefcb9d3b5ac4736ccf2a92c293cb179e76eb13ed318b26cfd5ff91c53150a8e8ad4f20e039af5c91b642525e76cd1b7d6cf668582bb88e5d4cf8fd8c2b56b3
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerrezer0spywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • rezer0

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2