Extracted

• • Target
    new order.exe
  • Size 460KB
  • SHA256 17f03be988c83db9df04d65fd5a5dd9e006604c53ce3266018efd90ec295ee9f
  • MD5 6dafba3ca14bebadfe9ae0ecf4abfd13
  • SHA1 c83b9a73e01fdaf5842ee29f3fddefd6db07264d
  • SHA512 9b02a3912e4850abcc4f2cd7256923644b4ea0a595c4d44c355d524344b2494d1c243ee3043848e046f3cbe0f4f473bf0106d95614cf8261693c8dead9abde28
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2