Extracted

• • Target
    Vietnam Booking HC24235.exe
  • Size 826KB
  • SHA256 cb2b905ccd8efafd5533e3d1035c449368e8d92a9948389c7702dbd7a86e226a
  • MD5 8329877a0fa230bc28caff5e76523ca3
  • SHA1 4fa6fd72956d1f138745679cb74432a2d51c48e7
  • SHA512 97c1c8a2e2e4459b35713a9d8541ee30093813b2fe4e283bf5928048d9d533a2b36b0ad7587df60fd2d66299cbc7717a791f63f9cf315d5de093d155fa7f3dcb
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2