Extracted

• • Target
    Vessel's particular_DRYBULK.exe
  • Size 531KB
  • SHA256 8408707aaa2dc1118bda9431f110e265d716b5cb5bc0ca8a9655828cad8b7b0e
  • MD5 5b327a3df82cdcd9e52e594b960112ea
  • SHA1 842e6d5d2abe47fd4b5b1d566b6daabb638cd436
  • SHA512 ff1cfc7a6eaa6d230edb67ecda3454c2efa219d74976f9dc801cf408039c50ef6e75b195cc4f166de97037bcccdbf89edeaa5f08dbb6ba17b54f428b650c3f17
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Nirsoft

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2