Extracted

• • Target
    kopia potwierdzenia transakcji 07.06.2021.exe
  • Size 752KB
  • SHA256 67a9ed854dd12e71270ebd7bb9da03031b26730b1f33b462732a056025093873
  • MD5 acec60f0953833c375532ca3438a2eb9
  • SHA1 0f7508eea0dbd0631d479e346a6b3a45931785ab
  • SHA512 22a918f844d58ba980df364a09fb3dc20e28e5e02248f7b1696d4c243232e41b128ce457eecf028390931ce289222a5578ce070d29adab291f1ba6a9147a4b46
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2