Extracted

• • Target
    Order List & Imgs.exe
  • Size 732KB
  • SHA256 f963457d5a9d27cbce5df7a6ce4fb9dd288e23ef473bd90cdb3059d454949d5a
  • MD5 06695b1a9c7382b20ed1c22e8eba9bf2
  • SHA1 8bafc0e97bd32bf77b4dc46694187dc1129ab913
  • SHA512 8570ca430470c37948ccd1d8109633fe7d4547ba9bab7ee9bcdf71e37595ab7f866d1111d4093a8620dcd563cf5be3f2062835305b7ffa39b2eb3bca82f39e02
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2