Extracted

• • Target
    aa6188735d110b3ad30cb412eba396a0.exe
  • Size 596KB
  • SHA256 e595987e96c536ad8be2aabd554d6c0335ddb93f059982a2a4da1bbd88353229
  • MD5 aa6188735d110b3ad30cb412eba396a0
  • SHA1 1ca45e56ba6cbd714ed5aa0f120be1e80fb38722
  • SHA512 40e46bb0e08d7e482569f5078e32a12b8d6453edcf35cbfeb76e7fa4459d3dad6fb475389169698928e441f2d189f72a61cbc062ee4677d5b73c70807a3884b0
  • MD5 SHA1 SHA512

  Score

  10^/10

  keyloggerstealerspywaretrojanagenttesla

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

    keyloggerstealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2