Extracted

• • Target
    2Neb1R9iadnXEq1.exe
  • Size 518KB
  • SHA256 73ea7d88674eb985176347ebac51ec05a763eb59d39b072a6ce1eb495383a9db
  • MD5 1ad8075e89cb2c17a4a8fc44187a0bf3
  • SHA1 4ad6df2038a124f189c7e8cadfa0a9e8e674d571
  • SHA512 c3a1fc255a594615a68f199e9185d0982cd63f00f76a49601fb23a8a214b5f9c64d664d2bf5ba2643d155291a814beabcce3707aa41d47245dc4a9cf19e4888a
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2