Extracted

• • Target
    mollyzx.exe
  • Size 1.1MB
  • SHA256 ec73d814f91b3348490ee9eb4330167cbd5f29886272c8e4280e5204fb98e5c6
  • MD5 1a9bd036108bb6bbedea40a918554bb3
  • SHA1 c0087ce64b4c9ec81774d8dd992f457472e8a344
  • SHA512 f40a004890bac8da4240ce4acddbf862729924f9a284075c9068109e24a7637b7b8d5bcb4b96570c3de6d9d62472e4085d14774b05b05af2d1c5b99290d6418a
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2