Extracted

• • Target
    NEW PURCHASE ORDER FOR OCTOBER 2021.exe
  • Size 513KB
  • SHA256 e57cd18f57da68b90790071673ac21fa6bfbb9b2b54451fbe4276fc506536719
  • MD5 96b732aed307e56b9bae88088b863da9
  • SHA1 df468f99ad3d252f1a6f62dd39279122954a5f02
  • SHA512 a6a8eae9693d5deb2193495aa26f9e7f9f5043576698222d4141ec6ea106c0e15698aada1d7e0e6a4ac867e4093fef270dd1bb31fe23c4a5e0d108fd6ccafa75
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2