Extracted

Extracted

• • Target
    f9caf9f83cbe337855bf4b1197096ebc.exe
  • Size 655KB
  • SHA256 c5cc30ea5b9f4701271672d38c1199c0e9bcc8db08aabd8addc1c92a36b248fc
  • MD5 f9caf9f83cbe337855bf4b1197096ebc
  • SHA1 9efa61b088492cd9a060489aedc22f660234fcb4
  • SHA512 1f95047ae982653268cd51e4db57c6eb43826ee91845601e1ac25507d2b43458a41b459f2d087eba6c5ab3ed5e0a49777633a129e7f6a1d43a9fce6fd8fd3b71
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2