Extracted

• • Target
    PO44087537318.exe
  • Size 726KB
  • SHA256 f8e79509055e8e73a467ac3fc37c303ce1968417c0d4cc76df99af32cf692f02
  • MD5 7074609669cea6bdeb02c813c132a503
  • SHA1 d3c0d1894a229f1c16e99d0fa4d3e9b6f2dcf7ff
  • SHA512 d8d58c2b1d3ebc9fb70a9fdb9d5a3ef9e87c482c842344f64e738f811d4ebc1ff9b606efd238227ccff867931e1ac5c78eb91af4ba92603286b5198fcc25bb1a
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2