Extracted

• • Target
    PO #3400123.exe
  • Size 599KB
  • SHA256 3bf2b67fb65e52b1ae2091d5ae6d569079c6fab8d5d99f8ebe0b179158efdacd
  • MD5 c652ade795d449307cf5c8af2f15b567
  • SHA1 5c39c7da201408028cf5482f177b443430ea5b60
  • SHA512 72561e7e368922d70a8c5879f2ba4c8acbf1fd2e83813a6eaed5f003008614f8c8bc7995b4fb11c1bc971aa1d19e6347cdb90d56c292a86ccd0a2c2bd4d2360b
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2