Extracted

• • Target
    SecuriteInfo.com.Variant.Bulz.339626.3605.3322
  • Size 31KB
  • SHA256 cc82ca8892ee89608d68cfcbde5d4268cf57a62468eb5f4ab0e95d778f05a9eb
  • MD5 f33ad874f978a5882b114395cc182978
  • SHA1 6920bced79b621aa7c6d4c43e06512fb3ce47f72
  • SHA512 40ad448c3f8c8d8678836392ef519ca9292408430c5c650eed215ab782af013ac50350275e338cbdc1f1c345b5b0243fe1197f7e4717722fe0242a22a1d86e20
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2