Extracted

• • Target
    REMITANCE 103_03435_210408_BSA.exe
  • Size 686KB
  • SHA256 7da903dc2abc47ad0b16a457e013a77e726fa5a984829ba9f226dc984e3a7361
  • MD5 d2e0a40064ac60838312c389aa37192b
  • SHA1 8f49d5fa04b25c34e0a0c51c4f22ba0f8882c737
  • SHA512 c24a96d022bd797a05a260fd79cfc2a7ddc84ab602cf8ca2ca4f719b7e36239a46ff715accaa06254d746614eb35ae8415ff1039815a41de193b36795e3105c8
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2