Extracted

• • Target

    PO345678.exe

  • Size

    883KB

  • MD5

    49176bcb0b146d290d9a02e78b57d4df

  • SHA1

    aa04d97bfbe65b9cbce4ffe9488df2f25b3b91e5

  • SHA256

    943cfd0d793dc383dfa4672bf1d2b6b67d4e4dd75b3de9fefcbbdf1f33027f8c

  • SHA512

    9c3ca652ba81e748e7499934494acce2bbd3f36968423098c71f23223c3ff430c658ac8214ebbd2ac987267e29e3f5997b5f97121511e55ae463e2ccd24ce565

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2