Extracted

• • Target
    7dab8befe9b5f46933b5e11d297cc2ee.exe
  • Size 24KB
  • SHA256 50be531a65362e72de7dd235671c5bd2bd8220e7fd6312cb2e2ca3272afa3fd4
  • MD5 7dab8befe9b5f46933b5e11d297cc2ee
  • SHA1 bf394ff86e230a475ba6028d7fc8ed04a4d0010d
  • SHA512 10a869f699b31b3db094026991c7ef6f882aafb485d11b89d18c73a1a0f425cad0effaf9e29d00ee35c0523f04661bc52cc3281198ce744b05c474a74a174410
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2