Extracted

• • Target
    Order#210420.exe
  • Size 1.1MB
  • SHA256 61f91b1ac578efd7d0eda15f45a7298fca86e41ab5f2c46e963ef950ac0df09a
  • MD5 80bf3d2f70c294bc8f260711b390a649
  • SHA1 3221d3ed23fc934b767fd0a5fdb1d2f853191ff7
  • SHA512 56abd572e29b62a0af6a5d7cb5ca85dbf40443f0ec8ae3a37b3a1fc280011f8a6161993415d6d6c618a64c113c617d794c20563e677987c94f65c4f835d85bbd
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2