Extracted

• • Target
    yogMjGlZZ84pTpd.exe
  • Size 906KB
  • SHA256 4e4c8a7b36db5f15e7f1f5676e9d5e2871d2101ca7e28349384a8cdb698a54ab
  • MD5 fef719e088516b81a176374c6d22ba42
  • SHA1 242aa309cd553ce6287026722e1ba59527c8cd64
  • SHA512 e57af2eb9670afb9147d0c6581e6ff34ea2918ddd4d7c1ecd4e8485e16cc002f4e4e0fc2fa047c057930fccaf7305055b1ae5d05fad751d9c4258cbabe029d03
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2