Extracted

• • Target
    obizx.exe
  • Size 652KB
  • SHA256 64a50e1b33ace0e3faf26026566648f4b04d90cbfbc197a27330c0d690e3be8c
  • MD5 d8eee8440dde12c5915cb7d7ea8c41e1
  • SHA1 2e7d45ff57410f1d144e914a616ade276a244f5f
  • SHA512 b22bc24a8ab44973c1e14b350ab7f5ad62ac6b88902efc1daa0f67b49a7eb3c454eec591801594220504d8c042216b2e8990e81fb6b465e4ce93a385d689a43d
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2