Extracted

Extracted

• • Target
    Download_Tracking_Reference19-05-2020.xlsx.exe
  • Size 417KB
  • SHA256 7b8323706153564b0355a421a3de33ee25da4fecb9e889e6939a4bf48c407eb9
  • MD5 21500d1b112efdc1dfc5b897659232e3
  • SHA1 65cd948f5db64a26010511708442c1aafd2235f1
  • SHA512 a26a9f777d934cb47fee8334e4726bfa19a041e140797e8b4e0e7d352782fd1dfe38aa68cddbdbaa33c6677a66b4296abd0d09f4f65339fdd3eeea6a21240777
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2