Extracted

• • Target
    841b06b50c50fb14aa583956475f860d25ce4180d9cd7d26090cc96cea3903eb
  • Size 722KB
  • SHA256 841b06b50c50fb14aa583956475f860d25ce4180d9cd7d26090cc96cea3903eb
  • MD5 b214138348543213d0247d3c1abfe5a3
  • SHA1 f927b7724e2cbdf35a367b38bea57d77082b57d0
  • SHA512 fb0fda898a3e960f5dee789f38ae429a27c7af83492aee6e7290ca6d9bee3daab1ff85704bdc5bca46a4a3d18dc13653b4324a84bf24368a1fc5e135c17df5c3
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2