Extracted

• • Target

    Remittance advice.exe

  • Size

    803KB

  • MD5

    be9f6ec429298296531aef4e8813679c

  • SHA1

    f46d168675ed61ded4d5030ad25b5107d5252efd

  • SHA256

    c45cbf7de196d50a6eb860e3d8dbfdf8f3699c3e62df58f63bd1c6c176c9ead1

  • SHA512

    8ee7421a05ac4c8f5b131ce57e2657d1128a8d0332be62ad42eb2850e04de85c9b177075f0dac51f5f308285843d534674f733d91a414bdfb43ecd6612db935a

  Score

  10^/10

  persistencespywarekeyloggertrojanstealeragenttesla

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops startup file

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run entry to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2