Extracted

• • Target
    2c265a8715c2c8f85d0ffea12226b8dd.exe
  • Size 1.8MB
  • SHA256 515aeac4841b51f4ef59ace6b939e49eb902b00c4bd2f7a0c433ac260448b93f
  • MD5 2c265a8715c2c8f85d0ffea12226b8dd
  • SHA1 69f37f4d9bc5399ac093f50c1b4e47cee05441b3
  • SHA512 af94f74235ead3d7c8eee1b13e2de0994b8c833eb721087e8a033e4e41b429983c461ae0ff7b0914f3129be3035a862eda7bce569d8aa4319233d8b53bfbdc8b
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslaagilenetkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2