Extracted

• • Target
    e8b97f6f5f99cde98b6d1c4f3876fb88
  • Size 464KB
  • SHA256 3a1b9be61ba5086622efad5cb7194a5fef437caddecfe615e1d6c0799bc4589b
  • MD5 e8b97f6f5f99cde98b6d1c4f3876fb88
  • SHA1 afbafe6f2cbccadbb9129cb3d2630e46d6e4223c
  • SHA512 93f19c8b2cc28568ad30f1e0f505070f41931d89a129a66672cb05d2149f6da58a4b543b25cdcf57c7dd8dac988e0a8b4b51a3af4f444a211bc65940b5d9d52d
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2