Extracted

Extracted

• • Target
    New Order.pif.exe
  • Size 700KB
  • SHA256 fb3d82bb5d2ea0c9636a4d2eb6137cee81026f4b348eef7c9d269cbc346d1521
  • MD5 147240336f98a7fc1f2062c57816a27d
  • SHA1 483d614d7586bacfefe2b8b226f22ab056682d16
  • SHA512 0d78df31bc774077efa876f0f2641037f4900fcb100a42d03f7e549192dbdb4814d749a3b0bbfa81cf32561cbbeabc8c2b3dc2cc0ad029cbff8e9ae95e466a16
  • SSDEEP 12288:0zNwnqs3y44sAGk0fGQGCSqrPzOny+qTGU3ajf5HkD8Zm4tAN92fXoqq3AjLc8AY:pnPAGk0fl3FPzOBqTGjjxED83tqcAA30
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2