Extracted

• • Target

    PO.exe

  • Size

    834KB

  • MD5

    5302a8a452ce7bc2e00673418a0b9e0c

  • SHA1

    b2416a62a12f92a6de666d45642a125ae024fd66

  • SHA256

    3d53dd72c07a1d6fbc44f658f9971383573ff28bb10e1f86049b79bf4b55011a

  • SHA512

    284ea997a04d33a2f058a770d2ad696b31fa0168b6e1bccab6cfc3390d0e41dfba43e978d56bc400109c06dc8a0804d6220b38ee79bf265b1d0062589df80665

  • SSDEEP

    12288:gYKci5+wSxBxHwSMMMBqCs+TJvZgwXfmBpFbLjYCiB9RAkg586aWHff:HKZrS/eSMMMsf8vHvwpFbICi/OB5O8f

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2