Extracted

• • Target
    PO#27585646587.bat
  • Size 452KB
  • SHA256 07e4cba3ef6fdc8fc35fd6787e40a308d39f4401a76e6c82eac2f13691c4d481
  • MD5 8007ddd3ecd0a9927f59a234df0ebdc9
  • SHA1 c886b6b895245534e955e91ccdb8d4ea67cbda1b
  • SHA512 ce9c2e2f12216c6380e9d3fc9df6be9c641f3825a25d8639cbcfb2929dcabd3a64cd839a6bd1467a0a3b4c85009d4c3e081bf436aa44ff73bd1b56b1109b4e50
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2