Extracted

• • Target

    REQN No. ABL-S205044A.exe

  • Size

    693KB

  • MD5

    dd721c67ab677be66d261ce4882c1927

  • SHA1

    1992c343145db201a8eed9c768d83242068102a0

  • SHA256

    0b0aea8b57dea40a601fdaa11920391e400fff347fdc1316e69c8f9ab47f5bb1

  • SHA512

    04753948b56d433fb74787fd667883ddd3a8d260cae1a9bcc6f7433552f88ae3bbc7b779e1d205ae302e6e79e82d8928babb6b7da123a1e99a70c4bdf09e1ab2

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2