Extracted

• • Target
    PEDIDOS RETRASADOS.exe
  • Size 1.0MB
  • SHA256 5776326232f8948c3e3bbbbb80ff0b1f50fc12df854c6eec11af2d4a0a9666f2
  • MD5 9f6e828e2b53b57f05701ee7aa81cacf
  • SHA1 9e97a04afb69edaba5d444f1163eac0fba23f901
  • SHA512 bf503c21c70482caa86ec223a0879f26b03ad5c3fc8d7369334a979fde9b7640d9203d4c2417d7bbf6eb5eb398942c66f56f26803fbcf672db8ecacd9ba947b7
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2