Extracted

• • Target

    8eebab330cd854bb3f426712bef9c2516abac5eb9ccab2f94139c0cd0dca6097

  • Size

    664KB

  • MD5

    563666da5f4e5596040e6c5ba17912f3

  • SHA1

    25090acc20c128e555e9b8922031fb4c02e00057

  • SHA256

    8eebab330cd854bb3f426712bef9c2516abac5eb9ccab2f94139c0cd0dca6097

  • SHA512

    95fd8c64acb431d8837f8e7122f8412eca11fa2b6047c74d70d3c224733e4b5dc6b465de7acb3d94f79734f139faacc5407cf124269543ec39286a109899b0e7

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2