Extracted

• • Target
    ea8d0b20907c22060806ea424f9d2627
  • Size 929KB
  • SHA256 1825b0aa486178b4a14e4dc3e8ce3f04180ada7aafcfb375e959ac0c1cc66fd1
  • MD5 ea8d0b20907c22060806ea424f9d2627
  • SHA1 030b18b713e364cc4d4e384654b93e970357765e
  • SHA512 7203b19b0c3dbb2d81d3c6f63b9971cd6079bf2297a72c9446309071c6f5760639a9763e53fa6c64a11afb863bd3f6f4256e1e68445489994891be697d310b80
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2