Extracted

• • Target
    Shipment Documents.exe
  • Size 594KB
  • SHA256 ba570d5e847509c2b56f4bd5dfb21115e1e9516481c2a89859c2f682786a0eae
  • MD5 bc62126f49c11148ff250f6d49b692e5
  • SHA1 ddc09bf1351383fe524bcc8fe543b7d4709b22fa
  • SHA512 d205a7e53181de67de9caa77b717f2f0298ef1aa6e190e7bc6c9c9bef0efe91aa004e6a644a9084e987633e4ec70b6dacd944980db282e1491ae78c5b49db79e
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2