Extracted

• • Target
    PO.exe
  • Size 860KB
  • SHA256 8d2b350ef1282afe80c0e468481dc0daa2189fdd8018a33ce5b8d67e8d52fff5
  • MD5 7cdb96610252bc8f0798e021a17e7c3e
  • SHA1 b37f8591b45ce86cf6e0257beaee01a400527eb2
  • SHA512 c3ca3502e1a880ac3ec3f0133efc3ca0dcda3086a13651b7a78e5df1fa27ac50005b465db58f66f259c381234ee72f4f0c158e9026bc03fa7949418a09a6a691
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2