Extracted

• • Target
    2 USD TT SWIFT _679388 190617_2019-NLCIV000003576_ES146009_30309679.exe
  • Size 427KB
  • SHA256 8af4cabaafaadb227fdcc2bd72da9d6b74cc50752ef4825360dc875a4762af67
  • MD5 3e77166275002dd0e4df595bca8dcaf1
  • SHA1 f9e4faa167e0b8e65e69da3ad8140888a572b613
  • SHA512 6769da4b10d8c83752611912165f9a7f139d119516a556a618e1f1dc80001425c574fb0bf5a1a12fb8c6af59ceded0e3c3a637ec11b9a990ce3a3b575b846ddb
  • MD5 SHA1 SHA512

  Score

  10^/10

  persistencespywarekeyloggertrojanstealeragenttesla

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run entry to start application

    persistence

  • Modifies service

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2