Extracted

• • Target

    rPaymentAdvice-AdviceRefA1282920Prioritypayment.exe

  • Size

    930KB

  • MD5

    fe72ed87a902b5d8a1267ba54f4135de

  • SHA1

    3a2a791ebf9f3a80ca2e7c9e04cc7d9588b5e333

  • SHA256

    156305fe33e5c9944f7de74cf2c94fa9ce976163c128019e5ffd761351368a09

  • SHA512

    e1a546b660635884ba041f3a713454ce7c972980e7488c6856b34d143fcf76872b2b70bcff0d66b4e0c17618e2c9de38e7a17f7e3abc2c3578ac4c00ac33c58b

  • SSDEEP

    12288:6PV/OigRfDCVAt0kvsu/RBdJUZRqVP3PMCd38ucaKJ0xl:vpRf7vv5WIPf/1t

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2