Extracted

• • Target

    ffe30c4ac40f0e43147b0ffe6ede3e3f

  • Size

    729KB

  • MD5

    ffe30c4ac40f0e43147b0ffe6ede3e3f

  • SHA1

    bde322fd8135752b32f0301887e25295a08f2b44

  • SHA256

    9f34067bfd42e0ddfff753c0e045a4a1df331d738ec6946ed35531f8cf33440b

  • SHA512

    1e70a0a0fb23c88f49fc702127e4d826454d4406ebee05d07ef341283c57fb1e12094ce3c4fa54e328771366dadc0935bf15d20a0d585783c0afe0002c1d7b2c

  • SSDEEP

    12288:rqZRCj+R1NCusiJrIL/st6cLA7RSAq+JdXOTNoRiRMYOodOrfUf2ntjjUS:eZtTIiugtZJ5od+TCRoJZdmUf2t/US

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2