Extracted

Extracted

• • Target
    PO2654.exe
  • Size 410KB
  • SHA256 e836f76c716c021e89d19ee4e4456e04b04b1041fe04fdaa6ac7523d35ef3b60
  • MD5 ffe7052ccbadd3d078c821e4858b636e
  • SHA1 481fa27f384714af7083134f2cdef37707ec5aa5
  • SHA512 e2e61fcaf7e6737cb8e03a8fe867d2983d5a011e7a11c278303d1e9f6ce8f779ff8ec20a6a14e6ae30f46ae2ca0a1a6342ff06f575ec7e98616a6b6c7526a984
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2