Extracted

• • Target
    attached wire transfer slip.exe
  • Size 777KB
  • SHA256 1948960143fb7d0e3c56678a5bd8d0baee4fa0c87d82b6dff5d7a3ec2280191e
  • MD5 511fd49abca82561848696fa6c402910
  • SHA1 9355ee4f4a5593dfebb590a2ee4ac04cf49c906e
  • SHA512 014b03d5314da0bd533b410028ced90b364dd09c1417a834441cf64f7ff372028479e21226d5290d286fe86130bf56337a25d769884b6839f37d10a5c4e815de
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2