Extracted

• • Target

    profoma invoice.exe

  • Size

    713KB

  • MD5

    205115d53c09553975ebe093dac461b2

  • SHA1

    e62dcafe6d96b592151c93b75544b3c211b238a6

  • SHA256

    cbf14746622e54452570f3b6b620d0831c788c28c8bbb0a1f6cb17746e4973ef

  • SHA512

    30ebce57a1ac51a4506e6fd2cba0e907738700d3670b07a9bc0510908b5aabdb0eb0fc08b1f0713f7dd0912d9284da94ec2979b4e22481eb720cb67a67f0f0e0

  • SSDEEP

    12288:mTReLAfP7wDj3ZiCx2D3Flbl0VzyLqSjaKIYiYP7x31gCrRowa3LlGqbjGU9+yF:4537wDjUxlZ05yLDaKIfYP7RaCNuBGqN

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2