Extracted

Extracted

• • Target
    529e59864d8d624d0b6f50ed3f29ab1a
  • Size 297KB
  • SHA256 f4d3d1d7abd51b08b3bad84d718cb3beaf9d0513422ce276ea2cc2617c3cf889
  • MD5 529e59864d8d624d0b6f50ed3f29ab1a
  • SHA1 ab9f4da9370828a2f03c186b99ab0fb09f397f22
  • SHA512 4227d264665fd926d1b633301bc37da0bb1858b1101847ba22527743e17b23371d1841c7bc971feeabca0ca658e3aafb22216c0eaa88423e1046e104910ffeab
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslawarzoneratinfostealerkeyloggerratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • AgentTesla Payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Drops startup file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2