Extracted

Extracted

• • Target
    New_PO.exe
  • Size 429KB
  • SHA256 f57973fe9b7144fd299f70cc04bcde1e442f6816de323361f1b09cb63c4e41b4
  • MD5 81ebc1fcb55cd9e6a951cc098af5df87
  • SHA1 6c02578983d218b042e035cdfdc60bb8d346c2f5
  • SHA512 a11c0417ee70ce59040b4f5f5829ba0b585fbb10ded18893f1c886ed0d93b08566e8397c69cb698a9d459cc5794d2f25f29becabade93a96f280638d1c314ed7
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2