Extracted

• • Target

    pedido de compra.exe

  • Size

    708KB

  • MD5

    3a701c8755f46b8a7a1dfa3d7abafa9b

  • SHA1

    643c4c334666a0feefd04f51a8f01cc20518910f

  • SHA256

    da66584117fbc144b1db99904d9f81dbaa7a7b37e5dc73f60761b79f4b800648

  • SHA512

    821c32c742325636da86be5c48576f0a75f6d58640eb8015da0ee9e15552bf724a26249b7ffd9972cae9462ccd803c4b5c0ddd3269495411b9a25f1ea8d9f873

  • SSDEEP

    12288:MnwDK+bmmtGO8j6fWRpN2fH/Bv2+wZdPdTQfgsOESjDDIAzF/Ze:MnwDK+DB3fWF2P/InbQDSjoA1

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2