Extracted

• • Target
    URGENT ORDER.exe
  • Size 894KB
  • SHA256 d688d50caf529da061dd41ff2eda749eb711a4b4b275e9d9c413b668fa320db5
  • MD5 b5f05b7766953e5239cef94adeb0ae65
  • SHA1 67d1414e2c7bd2c4e1c7425ed1cba34821ddb32a
  • SHA512 f6427b26dd035fe3d488a1d422200acca6948d9d1bff71865fe8456ac811f781c9bbddb18314313fa1b89d4502889820788ead99aa8a64e0dd2138cd81c413ed
  • SSDEEP 24576:8ycAKI2v2PbOmb6dzJQweNO+SfwzY3biMDxwg5+R0o:8ycpXv2imb6dzKc4zAbiM7eZ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2