Extracted

• • Target

    PO-32221126.exe

  • Size

    680KB

  • MD5

    85b21b780b5d3c51ca50a44e81d36429

  • SHA1

    90c219c7ac7e8f0ccdf2e6ed725272b1b486c026

  • SHA256

    4ac2605c528602e4762b48ea363f41702341d183d311b292824d66545f28d2c2

  • SHA512

    ae1ed364ab9240f6b69aac59e7c1817b7fbbd208a34adbe3aef13ca8e151104c3a7f5ac8bdd10c6a8eb13c77ddc2a5b5a92b38c2fb7af0d44d2350ff8dff6ba8

  • SSDEEP

    12288:ZJoaG5ISZV6LQ4Lg4G5NaxSqrg8OyV2cQ6N2REpocLQ/UUzcJ:E5ZZV6E4PG5AxSiu5s2R4Q/xg

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2