Extracted

• • Target
    PI SYW220.exe
  • Size 959KB
  • SHA256 0caa90f555f45a4fe2038ccad2b5a65b604ab7111a713ea7c697bf2c77e5df31
  • MD5 c3140f167ae91e46588d3e20dd0ed80e
  • SHA1 25264acc812ccf03b5c66d2567284730f71226a1
  • SHA512 3b2aa9fc2866f48889818bdd19fe882e1dc3cc5911cf841a12f8f57e51cfcdb98cd8e1715f00d1c95c4974ce71b41c40c27d782968d58a000006b1cb7880d75a
  • SSDEEP 24576:PtAEWCUxiWSHlYhrt1513CtMSxg6uKWVsgNn7HXbMP:GT1QMSrPsNnjXI
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2