Extracted

Extracted

• • Target
    CTC Int'l Group ORDER Nº. 19146.exe
  • Size 465KB
  • SHA256 9ff16ce8c4c4391af430eedc58a23ea4d004c597a7ee79790896bdff9abe7700
  • MD5 9343fa14ad82a71a74e286a159acb84b
  • SHA1 c516c0f69915548e352bf4716d99e399a9449b5b
  • SHA512 60d1934d5cc7043fa09f6333e95e2893ae8fd6053b090b4135bbb373e24bfa527ec1ce0d59c9778850397767223494c19584d1dd97b92ad15f4b4487a8300456
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2