Extracted

• • Target
    NEW ORDER.exe
  • Size 578KB
  • SHA256 2f6cb76b9e5c9af6f83539f84555b43f3df08046c8b796fd25afd04587f87fe0
  • MD5 02faf6f4052404e417eb0f7833ef021d
  • SHA1 8e1cd8bf0a80400273a78fa82d47321a123c60ab
  • SHA512 e1d1211dbb3233bb58cfe84667a795227167e1ef830bc4e7a41b2b433b9c446ecc55f4f5cb3ea9b80c56fad5f93526c33582c4c2430f7ef584b06a141c764f9c
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2