Extracted

Extracted

• • Target

    New Order.exe

  • Size

    640KB

  • MD5

    bca932f9df0a984231fd9855747b4dfb

  • SHA1

    fa0b4ce1a7e659e397566da2325229a5203953fd

  • SHA256

    9cadda8241bb7393ed10e4e3e58b0cafddb31b01334afe38ebb3f94e73190c2c

  • SHA512

    7b989799f329b5c779792cdd6197b8a64c379b1d6c79afc68d70666026b68ede9e91f374dde0c7e33c418072f5bb4035268768ad5c1b50e4c6157a7c4d6f68c5

  • SSDEEP

    12288:3uPm4WVKFOVclXp0pd/EUC/fzbxha6MOnvVYQazzq4Cp158SA:im1VKX50X/EUa7apYdEzVSYS

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2