Extracted

• • Target
    G3PKtQPPmMFXB4b.exe
  • Size 662KB
  • SHA256 5994f45fc95b80beb8ef828728bd8248455a7f2c503b025be6991a700ecbbf53
  • MD5 a1a8d71897fa2160525a6e5deac4b99f
  • SHA1 a45bcf927345f48943b659d8b483ecb7b8865a9e
  • SHA512 f7ab686f99d684deec951022c9b863a14d147d4d2e65a586e8b2ccfa0be768a960a29d6a58c352a75a54fc9d5abd11bc605c1c5dda85693b96b0dd773da404be
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2