Extracted

Extracted

• • Target
    03-04024 AQQ-T7630-CVE8.exe
  • Size 674KB
  • SHA256 35300023c3e0d4490e20cc16e4e35994e73ece38952e9de48cf961814cb3c139
  • MD5 35b2106aa5f1b539f968a477bf0538b9
  • SHA1 8f8cc70a453d0449e5f119efaa0a4e483b1eaec0
  • SHA512 4ccd582243f2db1162554286df6c9ddad7673b9a1550d67695082be9ed202e93e23b17544ab650298af04b9542221eb4cc0af4bb74545e230e00e220e855ab8c
  • SSDEEP 12288:+wIB1oVeonv+u0qhwAHdivCZlU5wcXmX/S1XxKjCxGPIrYi3:+wqo5pB9945wc0alDxAqD
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2