Extracted

• • Target

    NEW ORDER#031620BB.exe

  • Size

    707KB

  • MD5

    d32699595fd60818d284e465c8fc18ee

  • SHA1

    2c48211a9a83960c89af94df9fe683825166c045

  • SHA256

    eca7bee8699f515de25ff878600ee19c050c7633a55b1498cfae68463b4cb63a

  • SHA512

    69a5c9186cd2ebba4431aa4134a6f2e6495a43f29df2cc9171972c64f8e6dfac554be0e2fabfa0a3e34ab31851e999f30fad91454b3f9de31742fe11e534d6d0

  Score

  10^/10

  persistencespywarekeyloggertrojanstealeragenttesla

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run entry to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2