Extracted

• • Target
    Payment_Advice.exe
  • Size 554KB
  • SHA256 1658055ad28d2d1bb9baedc77dc6b2e9bd52b3f27d0c08d5d357925a41fdd5a0
  • MD5 b613f456425244f203571f5c7dfbc053
  • SHA1 f06d5ad53c0728e3222c008a5de083ab05c8fd15
  • SHA512 a2668da84fb9e107bb9273002c1484d52b8b4f84de930b88c79b5ffa7448a2075091a243970b5c4384bde81aebbbd42ecf4ddc09271e8937dc291ec14d05af55
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2