Extracted

• • Target
    PO#2042020.exe
  • Size 1.4MB
  • SHA256 807414adf7f3cb81f4b34edbe8c2ef5643c6f1dd780cefceedf07acad0989f8e
  • MD5 a804ffac3ae2bec0fb8033e2a5f8f622
  • SHA1 870f8bd8b5daa8e8cd2fa1456ed946dfef74ba06
  • SHA512 9645e35e6154bcdd6c295873a9790cd9739bd5f9b2e5516aeafe0d89eceeabd5a1a82ab33fe2bdb0e63fa87538c725249509eca651454496605f47e4eb0e6177
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2