Extracted

Extracted

• • Target
    b5215a5d95bd69c6435f8c174f0c060e.exe
  • Size 727KB
  • SHA256 a2b2d55d5396e41e9e5c05caea792ee7ea5656ea034e8d71865011503a62afe9
  • MD5 b5215a5d95bd69c6435f8c174f0c060e
  • SHA1 05636340dacba477a0908d46bc46f81ca64b803b
  • SHA512 a23e3f2bf6d7e9e0618cc5d8ca9fde35dd49a981bac421cc40a39605c2ccfa71eeaadcd3c65118c853f4be18769f184be04fef87c06b546cecd4b1cb48971e54
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2