Extracted

• • Target

    ta9hOZ9yGYrrbrJ.exe

  • Size

    662KB

  • MD5

    f4262471f23208adc42ffbcaaf7cdb99

  • SHA1

    7e858fab80da0e74ce6eeb5924841cfb8cfa41cf

  • SHA256

    1ebe798364b176f491d9eb6b1b4eedf59e43d712883460f61212deafb2ddcf6c

  • SHA512

    1b55467a1f64d21fcb26ef768b2f7c59070d766ef41574b2d0ae4f88d4ddfbb0d821b26ff1fa8ef126c1f24f10b3351f1a7576af619f9211ba4f270577f599cc

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2