Extracted

• • Target
    PAYMENT FOR OVERDUE INVOICE1.exe
  • Size 473KB
  • SHA256 2cdb5e01ac073690d5c4a3ed3ba53eca94dbb701c7811f088a89b8ca9a6e2670
  • MD5 17c013ef54d77f3a21dba1015a5d0a6d
  • SHA1 2e03a063dacf2ab5da74fc804420be20ec539235
  • SHA512 ca294feb4050751537a4f0822b40ffd4d03206aa7bdc5bbd43a958d962dcd93695fbb5f9a9226d9cbf4649952deed3eb36cb90596fc507160827c7ec95fe65af
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2