Extracted

• • Target
    mv Sider Capri.exe
  • Size 815KB
  • SHA256 f71e2502fed0fa64fd2bc7923c2135dca427d8c3f33b3da764562a6302657b8b
  • MD5 deb848ae83aa7466e417456eec6d6c47
  • SHA1 1cbf92ceced925c8925c54276f47d08b12b0374d
  • SHA512 27c69a6218e7e7d495796f429b4f80a13ba5a30304f44bd98d1754ac365bfa3efc5341fde05d4a6d3bbe543c358fba0bcb2ade6c5868899b26fd931906b48349
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2