Extracted

• • Target
    Company Profile and PO.exe
  • Size 877KB
  • SHA256 deeb0bf270ddc5c8a8e5d2f898d71de9d71009f9e7e74747ecfc3c399e85baaa
  • MD5 4c33263a8f1e4cd5bb7deac18328ba0a
  • SHA1 9a2e6f93eba644d0b33c902663bc30ed17cecfd1
  • SHA512 246b09fc0e76112eb3f43ba6311b00a50994861dece47807aaabd89b395ef9e61334d71fb764af4faaea9b9059f40b2c84b96621100217c37d49c18cab7ed39e
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2