Extracted

• • Target

    payment status.exe

  • Size

    1.0MB

  • MD5

    ab759a461499b48e636a608de3ae2ab5

  • SHA1

    f479d7f75ca2c650731cccaf4bc9f2804eae5cad

  • SHA256

    154126bbe8728f8ee8a0971e5f0d35061b99a99ca98ab65af51bac9e2449340d

  • SHA512

    b03ff1423c70efad1add8dbcf0a009467e8bf7f34cb881bb68e193158bc8fdf2bfc58f127523229c84e10084c6d20563e955440b3d7541ea4fcbeaafd275be62

  • SSDEEP

    24576:XebbwpRJTD2Ab/7dbHTBbPLuPEkS7MuGxnsSqGfbzebqfg/UDqT329VH:XOlAb/7dbHTBbPLuPoDG+8fbzebd8qDq

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2