Extracted

• • Target
    53b546cb0d9e9e8a27a1317e55086eb2
  • Size 821KB
  • SHA256 8d71a665c2ff60a659ff0854cf31bf09d955714611c2ee3fe9b884fb7c89b0be
  • MD5 53b546cb0d9e9e8a27a1317e55086eb2
  • SHA1 32bc0a70a570158a6c53ea7fbfe94d8d7a3d127c
  • SHA512 7a1b0087aa972bc67fb1df51dd81658383b829bc8cb25ae43a7aba2a4e0fdb9dcd1666d5dcf044f863785df816db086aca4ca12942328ebd7cd8c3a6d4358aa0
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2