Extracted

• • Target
    funds 1.exe
  • Size 684KB
  • SHA256 3944c8a551e1b51be2f29adf187b63497c7dab93f88755bc086f4e7fc30a759d
  • MD5 cb51dddc71733ccc1d8294adac7c90f2
  • SHA1 8e24714b193a743a24d7a89e8838d26fc26c142b
  • SHA512 b37c8b3daa8ef3a9437b102d240dc7205a0bcf01445142627ab2b2aee83aa9bae66d96ace97f9d3d2ddfb2855128d52ef0b2f6e7834601435f8550f3c78119fa
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2