Extracted

• • Target
    863037-Remittance Copy.exe
  • Size 671KB
  • SHA256 27e6ffdbf03abc3ce8fa3f8d8afb9deafcb4f6feb1b1ecbc56dd846e6b3bac37
  • MD5 68317f015fe6e324fe94626a717096ba
  • SHA1 997855478fdc4cb5c0d106390f9b882af0b7efdf
  • SHA512 8943559475c9184f0544a2d4f91bbd71c97541dd280b6a9781ed3945a3be334bedd13867e92d2b47e6d488999127f687d632b556dc9bee10e3b9b9e9eddb026b
  • SSDEEP 12288:eWmam5/yxKw3NMEA5hnmV2zwGWwlqMpwTnyQz9:eram49+5lmVJeEpjz
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2