Extracted

• • Target
    TT DOC SWIFT _679388 190617_2019-NLCIV000003576_ES146009_30309679.exe
  • Size 560KB
  • SHA256 cf382437f968ea64791cb874c73078d97b88fe64df18072459597944fd609ad5
  • MD5 028cf3989f26e5f3c75c5a84adfc02ac
  • SHA1 aad3ea867eb7e88f7d8ffb3b3074e8e9f5ec2254
  • SHA512 ac7ae89e5185f94e6952ebf8bad4164cc39dd7557d3d5ddc90da072ee272fa443071666fcac201509cb4ed7742d00c9a22ad5411b9ef717c8179131de54b9343
  • MD5 SHA1 SHA512

  Score

  10^/10

  keyloggertrojanstealerspywareagentteslapersistence

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run entry to start application

    persistence

  • Modifies service

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2