Extracted

Extracted

• • Target
    Invoice DHL BCNR001225724.exe
  • Size 532KB
  • SHA256 2ac0c34c2f1ac910d5147ba24aeae1d279252a16f195aafc997215b4491b52f0
  • MD5 e742d3e950254b0ee6ff1bd95f75f350
  • SHA1 c4483f66bfddb447d2e43f78a20f9d119aca00f2
  • SHA512 075a264c2480341328463825602324f53693dead59fd2158dca85d7025b435eb6be1446e087f0fbe904101f5af88f7f23b0b0c2a0a3f1e4fa264eda5782e2ab9
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2