Extracted

• • Target

    Orden de compra Scan_20200708_09351300.exe

  • Size

    568KB

  • MD5

    b91b0184fb8a98ad25a3e91b8e0f4168

  • SHA1

    cf866c5601bdb90bc5b72ad2175a215612a5241f

  • SHA256

    076580e45581e858d016af8b610744d3c83bdf83c62066178dff04db7ac71e97

  • SHA512

    92d6d964c40e2605a5e77af18a2fbaf384d4141790dc28d34628cd546d9013a00dbc7b3df2b9be4de4291f7abb3e124594d7daec13bf342dc7a36257681034a4

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2