Extracted

• • Target
    img_Payment Receipt_Bank note_jpg.exe
  • Size 842KB
  • SHA256 3c3c2afe57269ba1438595d34dfd3db570514bcf7b404a3ae8a38f8481729da3
  • MD5 673de3e057211724bbb7d641855bb3c3
  • SHA1 48a36274cb5e337a5de4ab471820764221e4b68c
  • SHA512 5e32fa716547514bded54260ebdda8ed07046175803dd0bfac423218e8a5eb831a6b91ee442b44011056b70c22a8067d53c2f441720a77e672a34e44ed4f144c
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2