Extracted

• • Target
    9a188a4b5ab76f5d53892f7bcd5dfbeb
  • Size 879KB
  • SHA256 12b582ab21f7f9cd0f7475461d4f3e12ea5b8ce8ea86010e062d6dc7b5d83473
  • MD5 9a188a4b5ab76f5d53892f7bcd5dfbeb
  • SHA1 b61e66760f0959fbb3f66daa0840eb40121827c7
  • SHA512 4c9590485c926d537e060d98c48bede5ce8cf40253ea2ea388e272a624811c7d418ba1c4e1c1f9794d25e5238a835175b705369a146e4c8ea38634680f35f82d
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2