Extracted

Extracted

• • Target
    ReleaseOrder_JLN14TJ2006302B_202019.exe
  • Size 449KB
  • SHA256 0feda673e5c76e32c520d867d3dfcac575f577188ccb49bb22df8fbc6a930ee5
  • MD5 85994a857259a9b2fa3fa7d27d846481
  • SHA1 706ff19f88992fd566b6e4f6f03f2aff35a440f9
  • SHA512 7a40bd9556c5d67013c677ca0059e2e87467f77b531683e38a0945796a0ca6276a943dbcc04aeced1017f8492f30d80a817877e70af8a38ad6572cf9716a0351
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2