Extracted

• • Target
    TT copy of balance payment.exe
  • Size 489KB
  • SHA256 8562c1e0b98bea014ed4cabc3b74cee7e4616d96f3d20ec6f88352b97fa4fc8d
  • MD5 9395c7576dba6aac80f1259b6f9cdc67
  • SHA1 4766672046cfc60bd7cc61389b87468bd651486b
  • SHA512 4cfcc32f1594adb035518f22e407c4100f405eac550b0e3447c3a1403b73e91ac808f2c76f99db213a4c48d2857fe608fa3519de643b253ce9774455f831e840
  • MD5 SHA1 SHA512

  Score

  10^/10

  spywarekeyloggertrojanstealeragentteslapersistence

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run entry to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2