Extracted

• • Target
    PI#203498.exe
  • Size 499KB
  • SHA256 67309e579deeb9fae0f90ce0e40e40318ef25c6c32b88e247863f13aa6678a55
  • MD5 73782309d2673290ba3a36e5488f36cd
  • SHA1 7924368a1460956d08d98db9c82ff2810c99c3d4
  • SHA512 1f654a525bb6b4df115886451d5bed9050216ab69724d9dc468a72f49d9c4fca233e35f27f48d8692ea55bb8af546602ec672f575d7c7fd1e4fd3c8a255db445
  • MD5 SHA1 SHA512

  Score

  10^/10

  keyloggerstealerspywaretrojanagenttesla

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

    keyloggerstealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2