Extracted

Extracted

• • Target
    U94iS4gq6npDj0h.exe_
  • Size 471KB
  • SHA256 53cd853ecfa2ff227106ec0c7ff70f25732d42a70a2f07274862e1bc5510615f
  • MD5 40cf722f15c8968a4cca3e9d16bedd0d
  • SHA1 896f2cb995555167bf9cdc0500c04d078537f637
  • SHA512 819e8070c75b57d5e89ebd0cbe2ca2391c862061c9f85d626a3c02656224e84aa0fce76b77be341c3090339f3bd840b227ca022b82e769c44b9edd342c83e6bd
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2