Extracted

• • Target
    UPDATED e-STATEMENT..exe
  • Size 1.1MB
  • SHA256 c03006ce889096c3287e0b33790e10b45b26a376e46bcfb89843f4cc577ca6b9
  • MD5 b72a74eaa8ff44c56a003f08a7c6651c
  • SHA1 d002b6301a0fee42fc3410166296b16aa1733a75
  • SHA512 fffd9ae80e94ec0dfce310c2755cd5302e737e93696dd30e9b3ed176cb84bcc040a7ab8ed6325614e52f2a0ebc006e4acf9cf0d592f79eb6f04847d36319a630
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2