Extracted

• • Target
    Payment Advice 09092021 HSBC096754BK56CBREF.exe
  • Size 497KB
  • SHA256 9deebf0b90acbe1b7d3c4afd3510c6b46b4376e7de040b65f0ac2814ecbe3973
  • MD5 e38ebd06bbbb835ad370c3c135eb6055
  • SHA1 efd3cd3eaee18662cb35856365e43fb211881c24
  • SHA512 1f5783e6abd99c7ef00346af47fcc9e105820c4d886fd0ce4aeb794c31284970c41fb0376ff1829cec56260352271dcb735120f88009a223eb6520bb938d017f
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2