Extracted

• • Target
    PO-104_171220.exe
  • Size 1.4MB
  • SHA256 00592be245aff458d19595b15bf5822f1cefc250e8554dc2402dbfdfb1196fa6
  • MD5 bd37a96c1f2d5ee4f1a85079e1d567d0
  • SHA1 1a2137cae45c9c7cab5cdb401eaa7215f2bce704
  • SHA512 5221f7d219df039365c83c7999d0270ba19cdecc194a384515bdd6e1ddcc0a9d5605d96bb59f80b0677de618d130243c842d323ede708b0d2321844b558cdc2e
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2