Extracted

• • Target
    73037bdb62885459d4748f7fb0baa268.exe
  • Size 678KB
  • SHA256 7607102eead4fb3d71ed2c2b492eb4828d5c544576102aaa94d29debce0f211d
  • MD5 73037bdb62885459d4748f7fb0baa268
  • SHA1 bf6582d99862e21b32d1b1e2c58c563bf62fd134
  • SHA512 de94243c1ea2b94eb7dd02c98e4e6dbd29023bf1a32b7f866408df96f2cd4fb5179504127a7199f0095f068215b981126816530dd07f656fe63318eb7d19126c
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2