Extracted

• • Target
    5e2e7fcc11bab293eba6ec68363cd6cd.exe
  • Size 32KB
  • SHA256 562d9a4326e09ecb7f988355d1d56c39d025f292c3d3e8a5e319a3ff2c44866d
  • MD5 5e2e7fcc11bab293eba6ec68363cd6cd
  • SHA1 c414d83a88d601abbe7d8bbe8eafde905be329ca
  • SHA512 9c9d6cd0f0a81d621b27143c462e407d862500601c8c51ea2625c279f854671c35558206d4598c04d8ec5d4aa8d1ec307f56ddddc1a749f687e3fa5efdc2643e
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2