Extracted

• • Target

    SecuriteInfo.com.Trojan.GenericKD.74311674.2898.29535.exe

  • Size

    49KB

  • MD5

    8a41760378020ab34b463912fb0897cc

  • SHA1

    057370c5e27938350dc9491aeafadaf80324d8f0

  • SHA256

    29d728ea6c0b2125e0141050f1e94bff73b27c1e61e2bf2604e46b50bc6dfd7d

  • SHA512

    40443829f0f42cd12b6f3f7f445feed2cf021af00437bbf2f69ff8d44c044e560c26088e222f1c376c5f101e2013c870abc18b0e9467d3fc4ef0dccc8bdb9cab

  • SSDEEP

    1536:82jz+wC4164ULzo2d5rrgjnumoDGpiWvv:8kM4164ULzvrV6Jvv

  Score

  10^/10

  agenttesladiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2