Extracted

Extracted

• • Target
    BANK DETAILSINCORRECT IBAN.exe
  • Size 572KB
  • SHA256 802f77b9123b032ae100bc645544b8fb46656d23b6d7dffc3e8e92c2b1d892e0
  • MD5 b9250fa203c2e23edd10cd227b1e8b3d
  • SHA1 337b5af5ba10b4e0ecbd9541c0609b5e77c8ff38
  • SHA512 1e4390d718ad1f1cd66e5e23d528dfb91334d3ffbf0fc14346875554c18d0944a7db5b472b15257e5406171c7164b42e7beb11d3ae08c8919f1e3822a30ccff0
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2