Extracted

• • Target
    USD TT SWIFT _679388 190617_2019-NLCIV000003576_ES146009_30309679.exe
  • Size 424KB
  • SHA256 f62f3cde15b3f736af8a87f8999149eb5e8ada35513883b56dc120db3781b20f
  • MD5 b588e0837e623179249b67cd2e82777c
  • SHA1 633eb25d1e555088518d4a04db5ea2cc9cef09a6
  • SHA512 1d43c46ef672abf38cc72067635e20b1360bad8a013fb9cfd1a42558d1b2b4725eb0ef953dea396832acced8aeaae2b58a4de6da89d12e7cd2b210f77e3baafb
  • MD5 SHA1 SHA512

  Score

  10^/10

  persistencespywarekeyloggertrojanstealeragenttesla

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run entry to start application

    persistence

  • Modifies service

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2