Extracted

Extracted

• • Target

    BCHILE-86712-K41-FPA-000018__REL 0017 BECHTEL.exe

  • Size

    700KB

  • MD5

    70412bb185c9232855032d5ea681f5d2

  • SHA1

    55f0e244005e965fbd0c9355ea4f4f51c824b8d3

  • SHA256

    e51adcf99928f26014b6993369a60a9d4371759f23ddbd4d0df10105ce6de848

  • SHA512

    ab20f06c0aaa1c57fea7b69e28f39a01739feb37e97639ceed29a7a573284081ad582bb5946239e592758c6fc8098e3b52a31e2bb3f4a1387196ca17513d6d81

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2