Extracted

• • Target

    PO.exe

  • Size

    592KB

  • MD5

    2b17ef662bfb9464153c8dbd60ccbad9

  • SHA1

    a2883daa62d0f99d6cbf8b51b28d3f479c3807dc

  • SHA256

    ad21aff38e3b20ca7c9c7236977dfb0821d515962cb5c705d8a5b9a8cbc43859

  • SHA512

    e0cb94d546284ee3400a2e8f372b3365c0686ae5a6265b6bbd598f33d677d0582d29e0b6ef33dbadda496f89089a89a3bc9ead862708c4f19a7a5c96793284b4

  • SSDEEP

    12288:Wi+rhsEgj79G/vpZyofAj+KD5icYPahZ:zITpq5icYPahZ

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2