Extracted

• • Target
    745876976Order98867.exe
  • Size 658KB
  • SHA256 fe3d080d4f87330a9c483bef058dccec56ec8926d4042b90f05e8640e49a0c31
  • MD5 4d97d0e5c78b79da3bea11d445b29cf2
  • SHA1 387b2794739426404b28555fb5c615784bc2ec32
  • SHA512 737c6e4cc260d450c378785d4ad143199aca13f8a483a255b2c0df0671c1aa3916f61053af88fa096ed017727328e8f91de74ed5daa7aa184aef88e5b2025cfa
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2