Extracted

• • Target
    1736e805c60f7caaec02db08e336d788.exe
  • Size 708KB
  • SHA256 e0704a694e935943ebadf05fac8e531cef005acab38b99a2e53ac0a101793553
  • MD5 1736e805c60f7caaec02db08e336d788
  • SHA1 b4eb9ea7f72921f533c3373ba47b6c7a33dcbf11
  • SHA512 28cf651cce2ab4c81348d902b385f34cb6bb0d6e77a8ed5b9d0a5606a8f9877ee69726996dedfdf58714fadaf2e0a28733276f097b4f243a1aad88e4b6de0de8
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2