Extracted

• • Target
    8da07b81759658eaffa2565d09b23375.exe
  • Size 751KB
  • SHA256 252d2ed7f7c35f65eea7a1d2a623657014252ed0c16820ecf3671cbecd1589fd
  • MD5 8da07b81759658eaffa2565d09b23375
  • SHA1 ae52f4d1eefbec207249d35a65a4ddf8bcadccd8
  • SHA512 07f1f24c400052f9eda7a0edf7adca61a5fe8c7447e55e6a7fdd9abe94534059dec1eb7ceeae06d2aac2271c43a168bab20b153ee1ee2f1fec0669a9975e4d39
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2