Extracted

• • Target
    new order.exe
  • Size 571KB
  • SHA256 271d599153db10fd4b2e9ab6e859169d74a4b6d5ce49d786dc392be16f3db3a8
  • MD5 68a71573ebeb03f1da55093030a0f215
  • SHA1 f1868c30eec7e1abbb650d9bda4c1ffef0233143
  • SHA512 99731fe81c355b92ea7c67b17b25844b8dcf8083bfeb121b07e641ad44c2094f3b666d680f936e8b4ea54a7fa1f0e609e3c60b4ab127c7f24c9a36e7a0a05d7d
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2