Extracted

• • Target
    PMA21-110.exe
  • Size 674KB
  • SHA256 5a82ef3afe4758cb4846122d6edc9cf726b6a520fbaff9452a32cce542c67dbe
  • MD5 dcb22bb98cedae340afba9a5a9f6adfd
  • SHA1 b7afd606c4286a213f5684b9b6eee4b61ec8ce08
  • SHA512 bcfa7a153086310556df8ae15c45183b967db14eefbf16d163b951b7b09890821b84d2d3521fb2af1da2865f2d1c1a370e72473b66e4adb528e7076b5e38bd5f
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2