Extracted

• • Target
    81087691531e08f2aba6005afd38172f.exe
  • Size 1.8MB
  • SHA256 09eca3324328da4f3d6d4f16b295e29aba08f5a78a82afcd0212554f4302deff
  • MD5 81087691531e08f2aba6005afd38172f
  • SHA1 c3248af594d3020180949e0e95ca4385fe01b693
  • SHA512 c6708adf64c28a7bb81c041a0693f4761cfd11872f1868d6d8a3707c17a59c6b52b9fa0aa58f6cc16bcf9495dd1dac5532a3d92e8a0e8ed053fb20089b3b6ddd
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2