Extracted

• • Target
    73000 USD Paymentconfirmation.exe
  • Size 647KB
  • SHA256 c30feebc86f3a83c66c8ef49ef5d9b4a48f462f62545f2e7038d36a0005bb983
  • MD5 435792c65bb1404fbc1374e5ecde5fe3
  • SHA1 153a26a20c85b6b8eefe1096ee03976c35b078a8
  • SHA512 3ed886ced5cf92713d3fc73f0b2b0999c5f174081642e00dcbae8e286bbecdab827ad2a1535d654a790e7476f48c2efa9984648adc7ce5afd289b8a38ce7d6ab
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2