Extracted

• • Target
    po_300989.exe
  • Size 433KB
  • SHA256 f187aab18607c012460083a62bafb6e17e1b9e6003fc0196695dfd48ae2eb361
  • MD5 5daa2b43601f84d3f1214b7dc2e7db79
  • SHA1 efa096b3c17d840cc0dcf4019be1e195ff019fba
  • SHA512 2550554a66c99dbd8ddb80eecedc41849c3c9a9d7766d2e5434a6ce965666e108bf57705e2b0c4da95a8b0092c39ead318f5ed84f640223406028f1c0c246676
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2