Extracted

• • Target
    Turkistanman OCT order Swift 40 deposit against order PO 277138293.exe
  • Size 658KB
  • SHA256 b27e64df6a3791d23937cdc503aa9314770409a13dab6565b05570381cd71189
  • MD5 bdbb479df705b1a6e1afd3b3b88bfd53
  • SHA1 e928def27acbf20c6e040a7636367f619274d889
  • SHA512 bc6cead7881226b46efabf2f8e50f63ed80cfb2211d59c4e9382fe70e153b4957c8a23c61ea29dcecd3b201515add9a3ce6b1bb094f3bc7f663b4709d88256c0
  • MD5 SHA1 SHA512

  Score

  10^/10

  keyloggerstealerspywaretrojanagenttesla

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

    keyloggerstealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2