Extracted

• • Target

    USD TT SWIFT _679388 190617_2019-NLCIV000003576_ES146009_30309679.exe

  • Size

    577KB

  • MD5

    ead08001bcb9fa496a221b48fe428325

  • SHA1

    d71a1a02ec57f3d72ce83dd7cf19ae6cde279450

  • SHA256

    76273b9a9b644e29ab62e389963e01a38af1882e7173afd9179ef487327e92a3

  • SHA512

    01df41873d19c450b026d51d872ffbd7180063f9c54ed06770f06a0986d0d125d4943f4c1efe85c646ffc2faabc4429e2404b528c975e4f2af205effabb262c5

  Score

  10^/10

  persistencespywarekeyloggertrojanstealeragenttesla

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run entry to start application

    persistence

  • Modifies service

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2