Extracted

• • Target

    FACTURA DE CRÉDITO E_Ecr_000800000108 (1)..exe

  • Size

    343KB

  • MD5

    c76efdb4e5635149c1b497d97a4f6705

  • SHA1

    ae650c66fbd30e7b2f82e00b05f144327855a242

  • SHA256

    8c25cf13e11a0e70496fd6b29c06791d67e88fac769bbc01b246f6b9185d01ec

  • SHA512

    449015833804ab73f3ec1a31b6398ee5e732ca2130a2a3478fc3a04d1472a070e8adf1c2416889a6696814d46078946a95677bdb596e974a1a32d4bb48006a8f

  • SSDEEP

    6144:zQYp57TecLU2TK+yo8wtWrC9XhRNnDRW5fZiIjQmlLE5AtWY1ef+Cs:V7acU2eFo8wgWxRnlW5YVmlLXrd

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2