Extracted

Extracted

• • Target

    Wiffle.exe

  • Size

    993KB

  • MD5

    8f8a92a532dadc1b18c0e00acf13c5c4

  • SHA1

    08ca73d684aacff6ed5d20fa389eacaa87ecc5b1

  • SHA256

    8230825616996b27eb6038c8a50d641f823388fa3b9e68a81b210e9fffb19ff9

  • SHA512

    9a3c06449756a86e2f6d066858945cd51c72ef11da117a6deec75a069ed98e5ccb4afb7d4a5d5b5e5104cf51315db1781284846b9acd67e144db054909f7b056

  • SSDEEP

    12288:6siFwjF/dKa+LhuikYEgciMKFnApF8T3glJQWPuQES4I+5jgrwiis:Fjs1ggciMKFApuTglmW23S4Hgre

  Score

  10^/10

  agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2