Extracted

Extracted

• • Target
    PO.exe
  • Size 446KB
  • SHA256 fd9d2ae85f8ee25995f7b8580bffd4f4fbff641edf5852e456cbd9df3c2abd19
  • MD5 04b3b2b2276270c97f310f5406d28ace
  • SHA1 dea3d6a58ca98fcc31c6b76422e2042248dae98f
  • SHA512 94e43e3a2ccf1379fc12e98aa0255488fbccc82e29b2972b5defc6724b78381b0d60ab73bd7a2c2bc98d66c593148c96199deea5eb2e5568607864fae6557f69
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2