Extracted

Extracted

• • Target
    MV ASIA EMERALD II.exe
  • Size 656KB
  • SHA256 9f732cea53ac9c8ee843abfba3235e2e11c3dd02d99da147e4c2a7edd9c02710
  • MD5 c5fdf66a3189687973be03a939081e6f
  • SHA1 43d52727b9acf0b67cf5bdcb0b1f8950a1e10d7f
  • SHA512 2d6d8868120b070651ecacfa62e9bb70d8c4cf8926450cfd3d142954b4ab5868c0f7edc6df496f62ea98be61f2d2846d082b53efddd285b0bc1d6ebf2b983a82
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2