Extracted

• • Target
    SecuriteInfo.com.W32.MSIL_Kryptik.AHX.genEldorado.6202.13290
  • Size 645KB
  • SHA256 df61432d145d18bbae2c09023908cf832d384f099ae6b00bfbaf22d39cec18f0
  • MD5 9b8eb2e7545cf8df638aa2e4462f3e43
  • SHA1 ea3b927668bfabb89ebc666acda2d8568784e9f5
  • SHA512 c449532e8424c5a51b879d1d7dd4417206b9da231f83c8ba61b368d6e303560e848b7a4955aa2d5e44f6f51d51edd28c08381abf03b3bc599ebd36cb644fa031
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojancollection

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2