Extracted

• • Target

    PO 4500396589 VIBRACOUSTIC SAU 071620200.exe

  • Size

    857KB

  • MD5

    f424ca247bac0cb89d2a970f548326c0

  • SHA1

    159b4c74d16dadd990b22b2b6b5cd30f7de46e36

  • SHA256

    fb87ac8736f16a1af756e71a59761cd17930dd4ff3083d0049bdae2d8b9cdd78

  • SHA512

    51a292c6775ba0abe9ededbd5c809c91554eec21eda62e0e2fa720e8ac998186182ecf7f528a89dd46945782d8caf4eb1068d14232826aaf0f186f9b46be7391

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2