Extracted

• • Target

    Payment Status - NAMI.com

  • Size

    806KB

  • MD5

    3d4646206820c5f3188862f88ec3af59

  • SHA1

    fecc92d2e0bdfdd5abe90548dd5ea3235bc7daeb

  • SHA256

    e4dcfe552c8f34aa797aebeb9b68988edb50ebf185e67f0b173ef7e8c57685b0

  • SHA512

    47b689548b40431c28e184e3c35980a5e6b216f1ed416c37bc1c4c41c7ef9b4aaed4f345fcfde8a91c5564249eaac26a563870f29bc6e662d9f861d80e82cf2a

  • SSDEEP

    12288:NWodxz5ZBGx3L9PhcXmBTXp/xqnylQ6J7Pl/pEL9X7cMRKs/H7RhS6KeneSiyyjK:nzFGxL9PhcXIqn2xdo54sjR/ned8

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2