Extracted

Extracted

• • Target
    KyELTvlArhdl7Nr.exe
  • Size 670KB
  • SHA256 21d9ef381a8b23032d6371bc8969b0565f13eb8e4b74dc38775bca233b79e8aa
  • MD5 eed865a1dde185ade5756052e0eb4e85
  • SHA1 661048411fe72ea0becd54f28374f70e4b2a2bb3
  • SHA512 a3fb1673d2cba81b0dd77323385c057a8096f2ae28f110a86897a7205f3973fb4da658d2df28f224c13518caf253a01fbec886df86675a1c674afb03936ce4e9
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2