Extracted

• • Target
    UIO90236789.COM
  • Size 879KB
  • SHA256 02c1c3d0a08dd710a016f1613832e7cf6f4da6dfcd506b9f8ca3ddfe0092f2cb
  • MD5 be5a74359ec11e5821f337ebd9bcfe85
  • SHA1 0a962444d27bf7b536ab2fac3b47589ed2968940
  • SHA512 b98d413cb85990c5da776d8f77f13b5b6c6478f025604dd68e83f6189db3f0e70bf725c84475ec68f86ecf15a838070f1cf3b5cc73b2470d1b63a2690f014108
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2