Extracted

Extracted

• • Target
    Re-Order PO102541.exe
  • Size 730KB
  • SHA256 2c87ef3a00fd0369ce619e38257acc09c8015f36b93babc8da79f57770e2a634
  • MD5 538b416ead0c7bae535a2ed4994a7873
  • SHA1 e67c6038bf1555d2219195cd2f578c9eac995c17
  • SHA512 33ed06808dd989730863611196eeb207c3c794c55f8330852b11e5ed138b08de362b6989737731db3a4900540a1e73b34fef245d5321e6558beca69a76f0c2ab
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealersuricatatrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • suricata: ET MALWARE AgentTesla Exfil Via SMTP

    suricata: ET MALWARE AgentTesla Exfil Via SMTP

    suricata

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2