Extracted

• • Target
    b965e20213ebff1b60c20b0bb7159e74cbaa6d6fb70ff5fe1d2f85dc2eb251c5
  • Size 913KB
  • SHA256 b965e20213ebff1b60c20b0bb7159e74cbaa6d6fb70ff5fe1d2f85dc2eb251c5
  • MD5 0a5b515f5374d3e5079a0f9bf17d3241
  • SHA1 3b6efbcb9cbb7bd1252c8b0b115a806e1392d649
  • SHA512 ee6fd6b38f74f5e9cfe4f9783715713cf8c45d2cee90e3d7430988950da1d1e523e1a59c5aac147479f958676a785aaaeb88e7ca3d5f8687cef52f84a5b3ac1f
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Drops startup file

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2