Extracted

• • Target
    ee5s192YZ34Ybve.exe
  • Size 495KB
  • SHA256 fa8ac3eb7439db4ff52b0a5078d22c95305a9bbff2d94292e2b1fbfb01df50d2
  • MD5 22e063aa0dbb42d3cd7a543e6432497b
  • SHA1 29ad8e9da8f93f2678b630328c0947f68f1a9d33
  • SHA512 6a032f5f50f66eef71af0812f71c868c7e73b9f2c9aa6ccb3d8ae5cdff89a0a6d51c95987842d8c48c068c870787679943c0f8d8de9984b2c518d6ec79b6fbdf
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2