Extracted

• • Target
    SecuriteInfo.com.Variant.MSILPerseus.227807.2953.29046
  • Size 717KB
  • SHA256 a56a122e4d9fc51551a7c7ea70458c0938fbd4620268ed1d14b393e1e68325de
  • MD5 6b7c739724a7e18dfcf1af10f1d8a8b1
  • SHA1 41f02e15acd4bda4c278b29646fe8cb37911a71a
  • SHA512 81664b70a92ffa1ff2568dc6a2c5cb3e8be89555d64928a2d667b0af743b39f806e272b5a264fb37236f0f3760bd9c80b1b21e30de427b7a3990c75e1f1f3f86
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2