Extracted

• • Target
    75ab568fe148e4d229533c5a6cd6b572.exe
  • Size 446KB
  • SHA256 fb91f67073fef8d391ccb08c31183ff2ff00e8a8ca0f71fb5bfce17fb0ddbd26
  • MD5 75ab568fe148e4d229533c5a6cd6b572
  • SHA1 27f2df18153729839b1ae3b0e579c1df0db59df0
  • SHA512 3ea21ae941fe9ba09e8f951c406e90b43bd64e50106a57893cd832ccc6954a77935982129079bbe402e616876597d0f71ab384cbccab2d323002bb8ada73ed51
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2