Extracted

• • Target
    SCAN3000098653022131.07092021.exe
  • Size 855KB
  • SHA256 eeb62d009f6218f682660a9b3e30a9af0d493102aff9d697b24212d83fdddf46
  • MD5 69fe97255c127e68a214693a19c72125
  • SHA1 061254bbea53a9c0325cfa596d0a3e53e79b82f8
  • SHA512 c643eab676aed1a9c5d88a7d1a3a186eb5775bbc16f0fd2d1551f71d56387eef0f37b20a6fceb38d593eb13205a1aea86fbd49987172d463732d2f225da951a3
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2