Extracted

• • Target
    BL & SHIPPING DOCUMENT PPTX.EXE
  • Size 477KB
  • SHA256 fe8b7dfe8bc6cf9d0bf54942b5bdb15a1f24cc9fd7b2f680413ec97885ec1118
  • MD5 c243cc720d1eda1c6a13baee37b4c1d1
  • SHA1 946a34575eb88801da37b1e6c46a9b6afc694182
  • SHA512 f72fdbcb27fa02127b61d80ee7e6556b37090bf15b1d14538ce4ab5dbc452f3d7585e0e1642a7875b17a1efb949e9d21e05829f62776fe77d0a42e568e1dfb67
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2