Extracted

• • Target
    Purchase order 4102543264.exe
  • Size 629KB
  • SHA256 1984e19ba7d38230238171cf956907134269323cbead0eaf3c2282506f950d95
  • MD5 0edf722f4870552e4d353492c0dc124d
  • SHA1 3dde0ae1a64cf262ee265d4ccfa07f4bd9b3a40f
  • SHA512 8d6f9c1b64e02e768289e11b76dff1853f9708fd8e0c1f433baeb4fcca3fb4321869fb33e20b964dbc011bcb6da47b38d618d628f4d82bc54b5687425be4ec4f
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2