Extracted

• • Target
    457c0297acb3c763b9497962dc440bc7.exe
  • Size 2.5MB
  • SHA256 f04d5b287971f60d5f04b262f3714a790b7d7c9b591ab88faa1d1f5244792d09
  • MD5 457c0297acb3c763b9497962dc440bc7
  • SHA1 9cf0966e538a770fd4bece35c18ed6c46a967abe
  • SHA512 596bee1b165e8c34a54566580d2ded7998fc5f3dd36255787f881ab6cf3eb1525492578d2a6aa64f8c7a4b027fd3ba213fd4e1ce36be1df62909d80dfc53eff6
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2