Extracted

• • Target
    SecuriteInfo.com.Trojan.DownloaderNET.117.13923.14318
  • Size 40KB
  • SHA256 e838818dca05da30d6307e7d6b0a724ff63c81bf7391e085d6ff60ff2320d03b
  • MD5 5163645daf1ee53e97815f97518c7a38
  • SHA1 3c585d7947117a64f35d0101d2205eebc29063b3
  • SHA512 5053a47b8b4cbaa98b209c97fa17e12e3124cbb8bc5ade8808823167c871592314f6b7b5e24fce847d4483d5701d61643eb76a7e5ed0655b4515fc68185db5ec
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2