Extracted

• • Target

    New Order.exe

  • Size

    734KB

  • MD5

    3e3175667f101af812aa1aca7f4e9a10

  • SHA1

    b46541a9ee94daa1dbc56ff4c6ff5a0824420f55

  • SHA256

    29b33dfc23c9d0fb7375b09cebd89658ed6b5cc66027512f1f697512209fc50a

  • SHA512

    0152166ac8dd7fb74cb2cf94562ba0f89f962c42a8ec51759a93fe24d7cba80b7052643c890eb62c1080f7c826f07cf7676aab42e5959a0c3b654f43500452ea

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2