Extracted

• • Target
    DUBAI 34243D.exe
  • Size 841KB
  • SHA256 ee7c081fae091ac85f5183f07128c756f8d5cadd515279c3f261c67291b8d8aa
  • MD5 62405d3ff4066f24f1d653fe593a9e77
  • SHA1 4d89dc84c1dd90d67963f7f4646f5748236206f6
  • SHA512 4e05cfed1e0a488a17c56c7bc8204ad0602f7501c98e31480ea86cb0b7c01dc1b094ccc21dbf5b9c0d4083c52ee58ad0bfca66b966cc1270659c9af7df9d6c8c
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2