Extracted

• • Target
    KINDLY FIND ATTACH RECEIPT FOR THE PREVIOUS TRANSACTION..exe
  • Size 851KB
  • SHA256 56839b17d875d76878a594fafa8e4ea0a8185391d43c6fcac8d500eb7baf6ebe
  • MD5 c16164778ab8a0260ea9f79fd09e15b1
  • SHA1 5683bec7732a3ceeacfd34c902c8870bf0b39888
  • SHA512 5ab590d47c9afdba5007afc65a715c19eeccd152b51e139d004b6103142a7beb53622c865a270ea4ee88d53fb60454099a4bbfbfd393432e1db5c05be3fd4927
  • MD5 SHA1 SHA512

  Score

  10^/10

  keyloggerstealerspywaretrojanagenttesla

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

    keyloggerstealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2