Extracted

• • Target
    d14ba8c9aea3b5982fa28b7d90f43535
  • Size 1.1MB
  • SHA256 6821b08cb8ebc1e38504de290856429fed68be2fcaa455e6dde2e6f9926787c1
  • MD5 d14ba8c9aea3b5982fa28b7d90f43535
  • SHA1 eea93b12fbad18e2f1176bf31d08e41c99dac98f
  • SHA512 0fba7e32dcb00a11e28d9f8829b497e6fb41c417856ad1b799712f081530b4a875ce0f1f912853c5ccdd28bcfb0e551d6c56aad915d7950c736839b54077a03d
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2