Extracted

• • Target
    Payment Ref MT 103 #159D02AE0010.exe
  • Size 672KB
  • SHA256 6014740a30fea5272a80b5f3cbe88ef2b54ddd33d8a37420e5e93a0999d81fbd
  • MD5 0bae3dd39aeebc469202a968bceb1d9f
  • SHA1 6481633b678f49af4f1ec09e49241ced678c3f5f
  • SHA512 ba95714da2ac89389058cd9e057cafbd90ab66cb624bed60f4b289be049f7c5640e2e4672b9eb2ca20824cea85f79a7b9446dd5996b2d7e37af689c2402a93a2
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2