Extracted

• • Target
    New orderDoc.exe
  • Size 525KB
  • SHA256 4a3cb269a764e5cc5039e72794fcacffdf8fff861e2073f2a8d27352996449dd
  • MD5 503ba2c6688b990284bd17e71b1996a2
  • SHA1 cfd89cae8cb02568bd905918eb2ae6d2dc591058
  • SHA512 d7c16d8a01968db629a6fda6d22cfab092d2db622ad898f08160ecabe4b60b3e8749b6292334faae86ad9411eaa3a1b80e81c2f465330ec8194090d83cb5dc54
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2