Extracted

• • Target
    SKMBT_28320092660933.exe
  • Size 754KB
  • SHA256 bf56f62cbc583924d71c51afea9546cbfd6dafafe877553a3d1ca37a25d34767
  • MD5 1d3d87c430c876912451cc352fc4a67c
  • SHA1 84f3bb7d81c458d7495e761151612915781f74e7
  • SHA512 e4e96c1420d3df05c9c79997dd5b66003d3f8f90fa1ededca79ff8d1341ee8dc289cbcd7c66c7ad1df5551658ab14017545af2836d122d84b6737f1cfc4ffecf
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2