Extracted

• • Target

    PO-0561.exe

  • Size

    872KB

  • MD5

    1d1ee6420acc590772ade92094fa397b

  • SHA1

    ff90ec2dabaf6506e0ff23a7eae6b99f7c0f99eb

  • SHA256

    c20bf46e171b1fb990b58670e5726d602e4b420b1391eedbf0dcc20db5622e1c

  • SHA512

    c6f4bd7c993fcbab859131ad48dd95f46420103832cbc7770a943bcd1ea72db789596021e96137f50085d87ae599d02151a5f60e9bfdc11afaacd71eb91bd304

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2