Extracted

• • Target
    PO_287109139.exe
  • Size 870KB
  • SHA256 cb939d718786f89ced507e2578f992dc26698ed13f744b5b7307f374cd24243d
  • MD5 e21ee77dc84ea28fa08a6e5f83bc25f9
  • SHA1 0ee070294a938f4b90ab57e8758d94260d9750f0
  • SHA512 b18cc222024f34a1361b3bc801637fb8e2fe6dc5ca3bbb28a3f8936acd09882d7955687a9103cc2823fc43787c031691bd99a90db3dcebb5b635558cbe676c24
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2