Extracted

• • Target
    Profoma.exe
  • Size 557KB
  • SHA256 b36bb088a516fe573f9d70983747a1753eccb0236bacd5f00d7cfe0cea99618c
  • MD5 2dda182af8da0a3176e878200c2ecf00
  • SHA1 b48551b7ca6bba518a043f75940375cd4f3f927c
  • SHA512 f30082c98f6392c565e1f559b4b592ab35d8e0bff3adb84912618cf84ee42c93ebcd54348d8ad9b66d884d7506472eac8d919fd618b8f57d70577d6bc30a03cc
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2