Extracted

• • Target
    OLUMBA-3212-HTC.exe
  • Size 829KB
  • SHA256 dbcf725538c71ca1b75d9bd06ef399ca8cd69d26151d1f84d3f0b62bef1ea03d
  • MD5 3299980d1aac8b29dd6b81449e08e48e
  • SHA1 ed4b1ff86823eb2df55575b2ff9c62c1a96434b2
  • SHA512 87c43aa7213b2d420fc0aa0a0d564e2ee044ba76394f108951454a28424325214127c9e7ccd1e891fea4476c44c73020a39d39cbd7370bc7e49e2248e636adb2
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2