Extracted

• • Target

    r9SWnqQlK8PFPEp.exe

  • Size

    927KB

  • MD5

    ab19c9b71f6af37fd29fa44377fada56

  • SHA1

    b91f5469e965d3cf9ef860ac39248ebdd1c16c3c

  • SHA256

    817f8cd46ad17c8f466e99582e24cc335ff5be48d6f8fbc6d41dc466be8fbb35

  • SHA512

    4d1ba2b85f159d0af88133f73be8af958432f91f5abd008b6979fe782e4e07c806509da2e7f2d0905ca52a46da8075e5ef795df0aca20cffbc418b96c3d81572

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2