Extracted

• • Target
    5f5975aa54916c31a205ae5c29c0bfe2.exe
  • Size 368KB
  • SHA256 043544fc666b260b348dbd6c004ac8a76c62418e34b3330e6d0a1fac1dfc3f9f
  • MD5 5f5975aa54916c31a205ae5c29c0bfe2
  • SHA1 4c309f984a5d02227773cf476384422aa8f34819
  • SHA512 0277be3783adf1266d77dfbcfa3f586ce58f9a63a5293a8cc75d21a7b9fa713c83fa7119fed892f320e8dd01b1940a6a1aebd5f47a62bb73a98b04101bf0775e
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslawarzoneratinfostealerkeyloggerpersistenceratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • AgentTesla Payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Sets DLL path for service in the registry

    persistence

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Modifies WinLogon

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2