Extracted

• • Target
    commercial invoice + packing list.exe
  • Size 727KB
  • SHA256 97938446027c2f5c4c5eeebff3b37cb3812da2fe45f092fbe84da5c590a25a85
  • MD5 943c81115f3e9d31fd1ef58690d46acc
  • SHA1 9979b550d2414f1e97d51b44116ae4fb14ea9265
  • SHA512 692a3982789bba23dc7cb2f358f673cd8aa1e91b15be50104d1c7f8e4670f9f38beb354a6f0df792b1b1a24ddb1f41e297b0a8a455b99571090699a56921b7ab
  • MD5 SHA1 SHA512

  Score

  10^/10

  upxspywarepersistencekeyloggertrojanstealeragenttesla

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Modifies service

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2