Extracted

• • Target
    PO.exe
  • Size 484KB
  • SHA256 91cab6b6ad40af70ba2bb3dc7127c4fa867334fddbbd5ef4cde09e0ee3ac636e
  • MD5 667d515a747c0df50fcf37a0f0965015
  • SHA1 804064ca829839f42ac7c4f15b7f3103df32cfca
  • SHA512 ccf6a547f4a89b2751f3ca3bf17aec6566e6dee1bbfa26b3dbe9b3aea2041ac217f9eca9c31b8849422ff3136cef5df2194c677f272fc2d53f746922ffce2f86
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2