Extracted

• • Target
    INVOICE PACKINGLIST600286 600357.exe
  • Size 959KB
  • SHA256 2b7b76eada5efd718343761b04df3d0910bf58a382535060d0e078736d1cedca
  • MD5 2b12964fa1e1aeb59391838e54840bb5
  • SHA1 b82efd6cb5d5614adb4d02b04f217987d33e9f71
  • SHA512 d00b6fcb645b0e06dc84b310c826042af1a736de4bd2439a3f9e16e87b608e640c560c22fd05b2e50cfdab713fd5505f3a2230a691bb5216f41e7d4139cbb9c2
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2