Extracted

• • Target

    SecuriteInfo.com.Trojan.Inject4.6861.3506.17315

  • Size

    896KB

  • MD5

    8ecb4e5a7e2da81cfc68069c61d873a0

  • SHA1

    e8c8d58739e60ef0ffa0ae2999b73eb8a711c7a6

  • SHA256

    9767f24cdeb959ecd20b003f7d9744c216b3bbcaae6ddc5d481a4cce2ea8e91f

  • SHA512

    0ef9bca72cc846949a8bb7039be6aaee3c56bf52642d5142cea50a5563130719bd4ccf0e8c5ce0598866aef5171c047faf378f8f0c5dd12ff348dc877cbbd6f8

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2