Extracted

Extracted

• • Target

    101764ZAM2024.exe

  • Size

    932KB

  • MD5

    448e34edd4314a1bea54de04047eb8ea

  • SHA1

    bb23a88feb8f95a28445df75b2e86505b6982fbb

  • SHA256

    7caa9b212df10474e2c16e256ef16152196b75893ad5344bb5e78bb61528a85b

  • SHA512

    19f14f521f6a4cddd954a84f22219e22d595f3f40f93d2b2f1533a663146e9b175e3c2e528439672643050f7ca03924798a42efc56eb6474c5fddf795d8c3c14

  • SSDEEP

    12288:FeZoT+KS7yWLx8H0zMVuG0CWlDkDyjF86ikHZUhh13HxRqkR:gZoT+KS7ygGUUP0RuujFV5Hahv3x3

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2