Extracted

• • Target
    PL-VAM 80031440.exe
  • Size 726KB
  • SHA256 347edc0f7def3d3ff474f0e96d8e9c3feb7d20039bdec2999428d913e3318172
  • MD5 9c0f23e7053592ca297b1b59e2538ee3
  • SHA1 19c26a4ccff90f2abd3f1821aa29f9d33272af21
  • SHA512 d6fef56ee3af4482b895fd1460c453ae4d1c5e4c26f42488a4568b12cbd58f3637807f7b48d22c8e7ee2d91a7ea31ffba9031ce899e365b68c35369f3bfa7795
  • MD5 SHA1 SHA512

  Score

  10^/10

  keyloggerstealerspywaretrojanagenttesla

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

    keyloggerstealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2