Extracted

• • Target
    5b5dc3238b5c70ae42e90e4428fe493eec98be9a4bb82bf23248f6d9e24da2fe
  • Size 830KB
  • SHA256 5b5dc3238b5c70ae42e90e4428fe493eec98be9a4bb82bf23248f6d9e24da2fe
  • MD5 7daf728518c5d8316bc4c8a37b6e822b
  • SHA1 6076f8029bd6aed7f8ad2e2a97db22ed0ac9ab77
  • SHA512 9e575fcb77b95479cc47c41b5d131d7262f966b149df18037183278e73d9013030a7cdc5a821737bca7a3488a22ac09c230a21a61df2f03b967c34bbb9c72e9d
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2