Extracted

Extracted

• • Target

    Documents of shipment 3-2024.exe

  • Size

    714KB

  • MD5

    779222c4ace4e7726fc76dedb4394b77

  • SHA1

    da183b07419ffb0fa4b72230cf540e8a09c64a65

  • SHA256

    664db26a69e4b1efb10289189887c35558bf7ca966eed02f97e523fef83f1205

  • SHA512

    b94ce6cba6aef492335628dc2456f3e7457e5f23ad646c5aa0b9464c9995f9bcd1df206d9d7563c7870566fac104eaaf900677f725041f197773f5d57248e5d0

  • SSDEEP

    12288:3fHwgqPPhZakohW1yCuTuFBQNfLTiYCDLxBAaOWHMoMYw6WsviE8O1QX9zXiUvlJ:fqajgsCuTSBefLTVn5SMYw6WsqE8T9zB

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2