Extracted

• • Target
    TT Payment.exe
  • Size 614KB
  • SHA256 3aa9edef2af34b3b432e934a41ef138b763cc23dcb8cc35a739cfb5903c1f436
  • MD5 f29872810ed494be553c19d06d1dc994
  • SHA1 a58a3947795cb9bbf86305bbc1d526cfb7629c05
  • SHA512 89da1ea85755964a3d9a333e33845b226658fcc0525278d6f1db53c4cf6f5af0aedc607f4f63a998d14d11ad80b42a268d200cca19148abd3de6b2cbf242fb34
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2