Extracted

• • Target
    PO 78005.exe
  • Size 283KB
  • SHA256 1b6a774498ff154b69bb5833958b8598724b82fb6d90bc561014d04bbf053ddb
  • MD5 62a09a2c3095e35c8165fb2359610331
  • SHA1 9a68fae7799ed44ad2470d024485b91b2ab28d33
  • SHA512 43f2e23bc6665eb0fb7d8e1a515ee36269844f6a4614dff8d373e28d7f5d9c8111e60050082964408b282c5d137d2a97be1e1e1b6ac1fc0763f6cc2a18326ad4
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2