Extracted

• • Target
    e3937ccb5d824eeed1726e1484751967.exe
  • Size 471KB
  • SHA256 4a60edca3a6f3900a39b164d5894137e4e466bae90a5287ccd9eebb4482b2686
  • MD5 e3937ccb5d824eeed1726e1484751967
  • SHA1 1451aa98fb207b153d01c0b101dd3f4cd091481e
  • SHA512 7a45ceb15faa5e812a87219ad1c14277461808549f08b74ec9f1824f567fbcfb8094c418fc99c8fe94f2bbdad83953107b12e1b0b9eff72cb4a4309d6d7a9ffa
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2