Extracted

• • Target

    Bank Slip.exe

  • Size

    812KB

  • MD5

    0eca1ff62f8625aa1c0489462855d6fe

  • SHA1

    4d9e6bb1d05523c70ed92a94eeed74c034aa2086

  • SHA256

    340d16854967a7c5d1b613d471f0b0c0ace3c88e26a38318b754df75a5638f33

  • SHA512

    9a16d88734e085d538c94cf2e263c47cc93fdd6d006ed63677522658a6c57146d731ee8bc6414011b222bcb5a04800db14be96290beab865f4c03cb3d219ec3d

  • SSDEEP

    12288:e3WDtW8G34/uK45+po2kCMe96riKpJlnbRL/m5UogjGD2JzxeHloX3lKX5JIr0:C34/up+pJkfriKPS5UoiGiByuX1KX

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2