Extracted

• • Target
    Order_List July-2020.exe
  • Size 921KB
  • SHA256 c4c50cf3bc3e1096a29ec0c968224cd64a080a34322d2f7d27a75d2f992cd29d
  • MD5 20da25eaf3a27483c08e99120b868454
  • SHA1 15e57ec49f0d7fc6936ca88c8946b97bb942e916
  • SHA512 b692fb1ddf013ae957c321ebe7208435e44abee321450fc299de675b7915411a3d0aada01d14d516b5490f2f9db4d6a6ebcf196ac6bb7c145b92558e3b168c3f
  • MD5 SHA1 SHA512

  Score

  10^/10

  spywarekeyloggertrojanstealeragenttesla

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops startup file

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2