Extracted

Extracted

• • Target
    Cópia de pagamento_0100188654_10062020.exe
  • Size 520KB
  • SHA256 4fc7415e4a84d6645a11260c1da7e68ed8a6a2a941cd706fc7060912ba4721ed
  • MD5 e74b8cea8fb9fe201f8235df4da3a99e
  • SHA1 0363872053a55f952dd3a31ec4652a8a6349e39f
  • SHA512 e6b5e6c1b47af43a2a222b6737db913ae4f639a4bbfd0a5c32357c6802f8d0f267cb3c56e3057ff02af779f3f303be65e07f58c94f8a54ea134541ecb3af8ce3
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerrezer0spywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • rezer0

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2