Extracted

• • Target
    New-Order.exe
  • Size 443KB
  • SHA256 2b0344ec35cc03c39de0c672f1f1a9348ea0cdf264c06864f03a81fe480c8ecf
  • MD5 f3d2356ba042a1965096955981861f56
  • SHA1 09bd38ed631a156382049fe7592c9b3d7eb3c30c
  • SHA512 4c7ede77c905c44a2e82bbf6e9fcae7d0ef03041c74766c195de0785f2c554c63c57ba105447df9092c5154f91b266f34a627dd7ae407e22ed94c7c33aafe59c
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2