Extracted

• • Target

    Invoice #765400.exe

  • Size

    1.2MB

  • MD5

    8c7184463be150691489096717df0e38

  • SHA1

    e5247c85b2735cece7b114db445ac7b98739b333

  • SHA256

    657cc831fe3eeaafccde4fe707832b998b699b1e7b525bc2d2fbcb5bbe3c7cd7

  • SHA512

    da58cb6e056d4c692b72115c3e8fe334816ad507e743f04824177bc8d0e55afdcf06ace2cf7a1190bd7b1f608a2600f7f18f4ee9f17a783205914033503c2fe5

  • SSDEEP

    12288:jFSMy5IBGtmQLZ91uk9v7JbGEYQMGhLHnvzxIwvmm2ieWpBxxw:JSMGTbxZQZGhLHvzxImHTz

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2