Extracted

Extracted

• • Target
    Induvac B.V new order po 20204122.exe
  • Size 488KB
  • SHA256 26ce355cc728110f631ee87676e90c6e6baea5ee64f327d5a4b677a96b82b5a9
  • MD5 f27b57f68048e928bd01dcde29b85924
  • SHA1 08427c27f88e1a09ce9425c123361e6b5514af5d
  • SHA512 99bbff7a3669356178bbf135429d56608d41645e0683c81cee7fac9e4f53ee923a7aea46d834ad3d208248ee1298cf901e4db4ac58d5ed7108a9ad0da9dcfdbe
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerrezer0spywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • rezer0

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2