Extracted

• • Target
    Amann (Vietnam) Co., Ltd - Purchase Order.exe
  • Size 486KB
  • SHA256 608c72464a4e7119e194ce6aebd289fcbfd82fc4111fe67514acb1fccb1ff574
  • MD5 1a5b7c70a1f618180f7981d891602877
  • SHA1 0ea809ca08077c14b1d98693ede077da8de84b54
  • SHA512 62d56290385a6fb5e7f717e4448e66ee389aabed7d4b61646d2f435af3ebdee6dd50512bd01ae07612f6ec4d5044b5f450e3611ec429720be5312958501f0373
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2