Extracted

• • Target

    URGENT ORDER.exe

  • Size

    894KB

  • MD5

    b5f05b7766953e5239cef94adeb0ae65

  • SHA1

    67d1414e2c7bd2c4e1c7425ed1cba34821ddb32a

  • SHA256

    d688d50caf529da061dd41ff2eda749eb711a4b4b275e9d9c413b668fa320db5

  • SHA512

    f6427b26dd035fe3d488a1d422200acca6948d9d1bff71865fe8456ac811f781c9bbddb18314313fa1b89d4502889820788ead99aa8a64e0dd2138cd81c413ed

  • SSDEEP

    24576:8ycAKI2v2PbOmb6dzJQweNO+SfwzY3biMDxwg5+R0o:8ycpXv2imb6dzKc4zAbiM7eZ

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2