Extracted

• • Target
    vGXbKUQZZpb0fE8.exe
  • Size 1.0MB
  • SHA256 b35c290250aa6e9744731e6d6cd3a744561c0cd0d19cf4641ec90d5113236b32
  • MD5 e943966994cb75ef67857816eefd931b
  • SHA1 4c6a1fd72e4b8e6247ccfcf4e2846f81a5627963
  • SHA512 bbc2772f5faa792f2cd336fc1f4448a8e7fc84e41672067c9a8673c4ba28199ec548e88a87921e9aaa1f79d49b775cfc0f137e7470469bd22565440849492095
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2