Extracted

Extracted

• • Target

    pay.exe

  • Size

    1.1MB

  • MD5

    519546d1948e6a9b175de49c9d802efe

  • SHA1

    43c0f9bbb62f00dd9c8f10e8eecc0c72ef25aeb6

  • SHA256

    2e59872a2d3fbed958f7e576b8b5f769d08eb45fcfd0dbb661847c9c6c7016fa

  • SHA512

    f12ac301703369e5c6f21086c3548292a697cff054e368d03be22ed8f777e53c730b6e445a5727e4e592f28e27a98e06c0a97d5dbfec691ddd6b001cb713a10a

  • SSDEEP

    12288:4kNjmHx175CFyHhi8q1YLL4Y+lUrJU0OTEnARmPT6ICIommv55:4kxmHDcohiB16L4rUtUPTEAgGICz5B5

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2