Extracted

• • Target
    211913490 - BL.exe
  • Size 550KB
  • SHA256 c10e72609ceae12c610e6c58a706c5bea0f962951e8366a8f6dee3cc42d0addd
  • MD5 c7297a3c07b73948bd168f1734abe187
  • SHA1 dd876ec7bca10131020329ee76c39972f28cfc5d
  • SHA512 3871416489649e38e91b2304fc70121f3654457aeb2915394b4df553961e7c48d686cd45558caa28a1bb2a28a664becd0d0a96e3d5470d5bc384e02cc8879866
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2