Extracted

• • Target
    Payment Notice dated 09.10.2023.exe
  • Size 573KB
  • SHA256 5977996d323c55bc5c986f78eac6da795ea114b0ef57d4f062ca618de28daea5
  • MD5 1fd8888d883175f52abba453a390244b
  • SHA1 4748ab3f1fc3a823ce1ae99db2661ff49351c668
  • SHA512 ee4e367aad7ee29295733aebc3cb27d9191eff29c51d46328edcb0ab6de86de6e6abd2ca0f8d8045f054f540612fea40cf75861b061071be7e94d3c0d5557538
  • SSDEEP 12288:u61k1vjJGGna1czoz0wC8tCARM9r3JJLlO+G7uhdbQ87g9J8vH0iu1:P1k1LJ1na1cUzLC8tTRM9/R67s2L93iK
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2