Extracted

• • Target
    ALTAYER STOCKS - PO.29IHNTHOUI8.exe
  • Size 611KB
  • SHA256 54d05b40cd778ff8328576a776c5f28c5bf6db2c15bd6ccb4dce17a27336d55d
  • MD5 5820f368d7b26d13b98688fc0e555b81
  • SHA1 01f17dca2c9305568bcdb109cebadd70b280508d
  • SHA512 9407ddcaab485d175e5c10e11f81abbeb1358d7c2d950e79f59dd67b6a901e784eb5592c4a97a487d23a5b873cc9b8af8624a5301a7f8ff29f27964b2d684f63
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2