Extracted

• • Target
    new Purchase Order.exe
  • Size 481KB
  • SHA256 f2179971d7a45be56da4188b09ef676fea06722eadfea5065694ac70f4c7ecce
  • MD5 e4a8224a67c3aa0329eb39f9d9f09615
  • SHA1 d79221437ee2e9edaf4f7cfc873cf0de3bb7903c
  • SHA512 1dcbc5b1a928c083a87ecc99c875c7a1769d5226f6c6326acf2fc469c09bc02c5906a7128eedbf8ec67dd162a804c8bf7aff7347c4c20636bba999cd17fb2367
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2