Extracted

• • Target
    NEW PURCHASE ORDER.EXE
  • Size 270KB
  • SHA256 eddfeca548fc1464fd8937442f58b868ade0a2a5b9a2780384cf622124b35c71
  • MD5 e2556f587891c051a883bad2d32be1b0
  • SHA1 dbe19ef6c963557b019b558a9101a67e51b4645d
  • SHA512 5338d70a35217b5fa32f5aceac7795c409d38693ef825be5c7ec3e43fa85814b40c4b16f0ccfb84c1b39cee3f719f96545144eee9b64baa04a66e82dbf997fe7
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2