Extracted

• • Target
    PO#12408.exe
  • Size 432KB
  • SHA256 8d586c82d5848fbb3bc04edb076ca3bef09ed04006357f15fca5a131a73f8286
  • MD5 a5be208c46915393d1d2a1b90fb734ab
  • SHA1 19620d7189a069f62b38ad35479f30aa87716767
  • SHA512 f86a03e9774fdc499671d7fd8985748578378383b0ea48061d74dfa97abb1e4e5dbf8beac3d62f4b84a55f3784bcce070db64b56adc2a8bc64a09ae993a7d780
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2