Extracted

Extracted

• • Target
    IMG_Scan-New PO #PSB-17398902, PSB-18384789.exe
  • Size 671KB
  • SHA256 a91034a005a82a1ec69a6682de74809632207aa47acefe46bf44e98af51284b7
  • MD5 be811f22d808c3f2e3e37d5dac4436b9
  • SHA1 56bf7cf1e7d71463958c229f2a7c04d62fe00b56
  • SHA512 64acc9997fbadc242fb1eb148ca89adf62d10f9df5c048fb17175021efb637f90eba31ae6fe00a40ad2b169d8386cdab33689ca232eb01c2ec9f2bf67f48e678
  • SSDEEP 12288:/eQ5vzintbbh6PBhBjg6bTfOYYWAqIGvYRA+Gd1Y10GTWbsr2PulEbapdYPNgcu:/rintI1M6/XIQP+4NGTmsr2QJwl1
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2