Extracted

• • Target
    DOKUMEN_BPN_KKST002_01300096400460026.exe
  • Size 937KB
  • SHA256 eecea13ce174c0e1a8f3799ded4f4862085ea3f1b3f305d610f662465dff8fbd
  • MD5 0d2b990d3f1e8210a0a59aedb5ecfd2d
  • SHA1 67262402b86b3f1802c205506134dc024c4301af
  • SHA512 6d3a5c575c57b6e28a574f415cd2db1994b78716f8a6cee84df6d028d0c674bc1b08b93d0d58cc04f72f8ff2f0f85e33c8e8daba9c768aa3b1ec6b446c01f558
  • SSDEEP 24576:kzPDJl8euDi4BJj3hBecb3ewHdqoXpDDL:EPDJl8euxdhBecb/1L
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2