Extracted

• • Target
    og7XPB2MCgUdGBT.exe
  • Size 476KB
  • SHA256 484f6592d90c1da40b43355a3ca07b1114407f90ac7096981b597a2d07b9d770
  • MD5 a25ff6f118f43b907552b347cddcd6a7
  • SHA1 0f9387c7ae0fd606fcf3858cd8e7bfd883486cfe
  • SHA512 c3a713b62b1909ab3c9ebd94ec9a71f0995de79fbfe26451c7ab343138518646a8488f77ede6ba577c3ceee506f88caf8ab59672feaf78d51e0864fc736564c7
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2