Extracted

• • Target
    LindstrmPO45676.exe
  • Size 711KB
  • SHA256 e5c5c9d753512a626d7bc4e6a14191b3db75290da5046b7d4d5fd4acc2ed3460
  • MD5 1a9146e0dc61061a51b98c1fb7f14afe
  • SHA1 55ec3db29f152c909ac6b99c40b0178d6f4f0ce6
  • SHA512 4bd64a1fa4e2049db02d45c95f69131d77e78cf1349e34543c0ffe09d6fcaccc925f8add6fea4e30d6bef622ac4a58f5ee45fcca106b0cec00f11fb3454f8e69
  • MD5 SHA1 SHA512

  Score

  10^/10

  keyloggerstealerspywaretrojanagentteslapersistence

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

    keyloggerstealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2