Extracted

• • Target
    ECx2xUjOPZLKfaS.exe
  • Size 561KB
  • SHA256 5feefba742eecb4eb287261d0d1b3ffa2a44535d88496edbc85f15975a471eaa
  • MD5 5187ad82b9a49cc207d7a783207f4f8e
  • SHA1 2f631e82243756ed81071b9c488d21ad17fda135
  • SHA512 5894680227d09615ff41b383d90b2bfd07d1835284eac52c4f26c3bdc2f27fc2e2649b751840274678e218ea3571540a31f272b3d17001a3fa43a34743a5cc66
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2