Extracted

Extracted

• • Target
    4d679eb00bb6782f97365a2190baaac4.exe
  • Size 664KB
  • SHA256 23b3667187a6f5abd57a39d6c91b1e7fd2d262a0cdac965e1ec368274ef465ff
  • MD5 4d679eb00bb6782f97365a2190baaac4
  • SHA1 df21c2cbc172f1dbc5fce829dcf0405b934aa5a4
  • SHA512 563b795538046e654829c0f23f1c690e7d33cb6ef63ecdf15374522a56c971b999b8b748bb8c15a01576f91ebc0c9077620603c34801d488f973ffe4ca5edf4d
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslaagilenetkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2