Extracted

• • Target
    PO no. 0107-320804-1.exe
  • Size 688KB
  • SHA256 45a0e874237e2b2ae5828e37fcf1600f44e35b5f90ebae5e56b42289bf9ce8b4
  • MD5 25ee8442205f13777e3b9b477f6e84e9
  • SHA1 8471ebfe5d87b9ceb30d5f6e93f22c1e14d0c28f
  • SHA512 e78d0a150764093c7d10f416930e35f117647a5da21d6a11a1f89e65ac20ac4b41f45723dbd5ed4a4927ce6672708cfbfd0351e9f90c8b7d82bab76575888cc7
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2