Extracted

• • Target
    copia rápida.exe
  • Size 734KB
  • SHA256 d55d2d247eede293c57801a6c95d720cd632836800d3bc4f778a2fbda27e5006
  • MD5 84621bce6328025373b86ca543453b93
  • SHA1 3dad8a07d31b001bf6c200c806dd365e616832a3
  • SHA512 80352dc39dc5eb005d0500b7ef27cd3a50b93ea44e0fb8c1fc597fa06c97ca348808fceddceee2bcee3ab034e45d371cf66ee11c310ff2efd083b2a72409f246
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2