Extracted

• • Target
    PO_LRTC17086.exe
  • Size 745KB
  • SHA256 15189732a875a6464e53bee90a29e181cd6bf8420b8b7a86f0cafd36e9e86a44
  • MD5 c16b00d793de82af17d09f4719610739
  • SHA1 02e5f0b35ad4caec4ebb6ae25b4ae5e155a78af7
  • SHA512 1681df7b0423b584a6c5be3308ae3d8bac74809e1c8735c141bb6da973e93383daac741b0c8a7f94d10d9e691b52170ba4fba640dda7a8f7cb7ec3f6c4ca2c4a
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2