Extracted

• • Target
    Bank Details.exe
  • Size 498KB
  • SHA256 fd2892b638fafa197381cb5733431ce920baefa842c17e379a809cc837fcb445
  • MD5 fdbd5d8a97e3037da2c542607bedb39d
  • SHA1 cd49cabb42a5729b4e4c48af10c48c2dacc45a05
  • SHA512 32262a1dc2670db89f65b60f2582c46e03a3c7bb83c132b8a64b368bb5f0cc566ee8a5aaf5c975eca7d744af82745d827d1069ad0f1e5f63aac0a07f8db66fd1
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2