Extracted

• • Target
    nwamafour.exe
  • Size 24KB
  • SHA256 8160d7520a2f9630dc0b3773b07d2a9fdf937f2b3b722980c96dfbc4db4a85a7
  • MD5 2539fb238bc5bf7d2bdd0b475e1b6af0
  • SHA1 25cbf70ad2aab4301cb53545e39ab1c23f0c12f8
  • SHA512 18bdd424e87c691401d4a27685fe018687081ce80aec780f925cb87e5615f4f106e9c01a065776185de543806688ce52ef924d7ee163ff71dbb6ad46a8d041e7
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2