Extracted

• • Target
    3b490a21fb403005a3428a873ec1a609.exe
  • Size 812KB
  • SHA256 dcc30daa103f38a83d8f731cf1d6dccdfd53d20e27b6944fd328cd78149beba8
  • MD5 3b490a21fb403005a3428a873ec1a609
  • SHA1 78cd0932113905d83ba72de3bfb02d3e96a30861
  • SHA512 f48ee1d55b8541d8fcc82af10d77aa3cf6fcafd43dc35b7250b9982ee938c8ef1806a93cc5483a55dc612f78331ab51775a6b62bc35edc8d79b8f16c6147eaee
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2