Extracted

• • Target
    Order-Po 463922900000.exe
  • Size 745KB
  • SHA256 cfdbaad170a7847c77fedbe9535a37a6d1107259c8e80f2c7e04a6b2895e86e9
  • MD5 5c471fd2fb9617ba41ab6a23eac80e0b
  • SHA1 aed65f0cb088517c57e6f2ff3187b812c74fce32
  • SHA512 d10c7d9f128080efb8f0a4278fe75fc9505ddff829e96e3559c5ae86c37e3da512b763d826c6843030e145608c17e72437b4bcefa698d4b8b96a7fc98d4178a3
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2