Extracted

Extracted

• • Target
    PO.no.12.exe
  • Size 938KB
  • SHA256 eb008ba066b894222717bc03df94f04541b98920f68c85a07277465dfd8afad5
  • MD5 92b31af297584fdea285036b968dd849
  • SHA1 f29366260138af4bafafc2d1006dd15fd8dd5384
  • SHA512 34b928b1edd6a073270df93835fce7cb13a5fe8d75d0cee1d8922b9dedaed7849050a5241bee248fe86b54a9f3c18795611fc838062c855d73e66111a18c0589
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2