Extracted

Extracted

• • Target

    Payment proof.exe

  • Size

    697KB

  • MD5

    770c4a7155b97c9ae3d3063b549be236

  • SHA1

    a03ba8d2304f7f9bfbb592e0b4890705931aee28

  • SHA256

    19c8294fa46bf25f304b34352f274c4ef8271ed913ceba438eff4db2cabba5b7

  • SHA512

    4163476d132052ddda57b683bcb34b15d2b6650a7ead32a02559d8a27ad4dd0f6b3cd38452507fafda6238bba6be8481ab214d6a30860c2997eb889bea3b5bdf

  • SSDEEP

    12288:NbSJgvm6ikDZcWcTHLW3D5POOgfG54IC/p2vNx0KWy//GgZx9jMD:NbSJgvm6ikSTC5eu54IcuNxfWw/5Zx9Y

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2