Extracted

• • Target
    Mouldpro PO 234200611.exe
  • Size 458KB
  • SHA256 575eff9cc32b30f7b274b3868cddb645286ebb701afefa3f5a57f489da11bf01
  • MD5 eefd2805241bfdd818a51a8d27332418
  • SHA1 0827a95182ad64f432715f89ac920360248d1f0f
  • SHA512 16edfa56ab5ac0b932b62ba1ebf5dc4df99345b2c410de14fe62bc977d8e08b9293d2bb4636e616e404dc9875100422778e5367bf7c67eb7f0c0dc148b82ddd1
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2