Extracted

Extracted

• • Target
    11065-AMM0000557423-736065949.exe
  • Size 455KB
  • SHA256 e390ee24fef5920157d9c28af8d232cd542f30b193481fef6fffb007631f374b
  • MD5 39b71dd0dc801e89e04f0d2b3824b55f
  • SHA1 5d3f749ab772af6552cc81d807c723e8181f5fe8
  • SHA512 2a9fa2de4f5f58fe6516ae2098cba672a2ec0e790334f2c310163789e2624df865fc05e7abc140acc914b3165d5ee89aaccd5350025da3d3912bd500b5f1a730
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacoreentitykeyloggerrezer0spywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • CoreEntity .NET Packer

    A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

    coreentity

  • AgentTesla Payload

  • rezer0

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2