Extracted

Extracted

• • Target

    a2294a1b6fc886b2150082727ffc9b8b0da044e85d08aa70d6638eae382d3fb0.exe

  • Size

    668KB

  • MD5

    6f08f49fc602eb0c23fa23fff58671b9

  • SHA1

    9a7642ed6547353c117e63d263540d4e3eb8b1a4

  • SHA256

    a2294a1b6fc886b2150082727ffc9b8b0da044e85d08aa70d6638eae382d3fb0

  • SHA512

    175f3fd4b43d69bb9bd9177d0d45a5ef8a0962183ad1473a168a65e3583fdb724f78e0cce1f6f2d5d30cf26f6bf14b57b93159bdb67226b7288d66a017770a7b

  Score

  10^/10

  agentteslawarzoneratinfostealerkeyloggerratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • AgentTesla Payload

  • Warzone RAT Payload

    rat

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2