Extracted

Extracted

• • Target

    remittance copy $58,670.00.exe

  • Size

    608KB

  • MD5

    dd7ac5f2109c2cc61763ae93e4fb955c

  • SHA1

    558e89789946fb4cfc3b63bc258ddfe23d42c558

  • SHA256

    84b2a0360556088e4aad29627d4ed15d53b18aa72d9d98b4b0d1be27916c681e

  • SHA512

    783124beae908538c6e19a710669fa7ea85a95778ca4ec06134d30599a284c3540752144f1fdc9c1cb8544f2cc13a7ddb478132a00075d93820952a13313bb87

  • SSDEEP

    12288:ptapNjL4yL4uaRt9f/JUfA2BMm/In4wqS77Eb7FnPgRh:DapFLXIt9fRUI2umawR4

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2