Extracted

• • Target
    d117d341d9bcb33ea142c3c7c457ff3c
  • Size 450KB
  • SHA256 ccf7cbe501b4e91d8f020fb061bbb24167316704bb9566aed6a6a5bc36df3d73
  • MD5 d117d341d9bcb33ea142c3c7c457ff3c
  • SHA1 3ef0de98d6d5db9a32bfc3e41850da81f8bf6cbd
  • SHA512 0a03e4dc4a1c1f876e5c33b54a013dc4de281fdf1cb21edf3a2b886f764ab062f96a898335410a247281628f91e068e4c9dddb3e7fce5b03b4132f78f981a365
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2