Extracted

• • Target
    Payment slip.exe
  • Size 428KB
  • SHA256 28d5e6cd0519719ea136a6227cb4a5d598bf3bef2d317c0edc64bc059feaa3d3
  • MD5 d85599a4afd0e04420fcaea0e7873608
  • SHA1 9f6a9f1ebae2a0668b9e25cd58beaaff31d33def
  • SHA512 71f6aa47ca46d89e9a1187205eeb6cc29d9bc835b7058462889548aeab4c944aac1dc7561237b5f3add1ac1260aae7654ff83115cb51690d7e823c3c3470f3bc
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2