Extracted

Extracted

• • Target
    PO message6112020.exe
  • Size 615KB
  • SHA256 8e7bbf8a58e3633c72514c11d5a4c161a6d2a2c9fe04111375ec4fa82580baef
  • MD5 c8011220f422e0a32de5c4d3dce6ecea
  • SHA1 c7d88161dea34f6e084b9b8954f91f41dd1693b7
  • SHA512 b61e81f7fa81a9967b33e57b1ab41b497f45087b6ad41381db140a15e4d7445dbf4db94e0739b6a4aa57d549d0de8b66eff847cda12ade73753b1039a4d4292b
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2