Extracted

• • Target
    PLEASE SEND US YOUR CIF PRICE FOR THE ATTACHED ORDER.exe
  • Size 23.0MB
  • SHA256 1f4349a08e548a9dbfc58aecfae2bf5aca9c3a6c765afc641447acf4818bb07f
  • MD5 b94c5f3f3d0a1e955d1ab59a950cb2e5
  • SHA1 d92fc04c4b6c7f5c4b92235dc3a4b242f79f6152
  • SHA512 0a82728edb28fef238b7cb2ef6d61d6b55c18ebe434bb44197152eac7018a8b9d0fc3fa5a7ca8a28a01f148b3fd06fe52dc00462085cf7e0123463f3f70cae1c
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2