Extracted

Extracted

• • Target

    4195248b7f5abab63c7fe783554f913c.exe

  • Size

    756KB

  • MD5

    4195248b7f5abab63c7fe783554f913c

  • SHA1

    1c2b9caa2c0b5a2439bb034b6dcd3d383df5c656

  • SHA256

    284f84d96664f2cd87973b7251e93e4e6dd0f954ec5f043c9f95e5cbddeb6420

  • SHA512

    a4c049569cfb2d40083c54d468394ba7205ce13e969e576680eb6763bf198df0f65fc03e2e3dba3e293499e648eecc29d5523cfed1c4d9440085a73f5f4e37e9

  Score

  10^/10

  agentteslawarzoneratinfostealerkeyloggerpersistenceratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • AgentTesla Payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Sets DLL path for service in the registry

    persistence

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Modifies WinLogon

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2