Extracted

Extracted

• • Target

    potvrda_transakcije.exe

  • Size

    631KB

  • MD5

    aa0e19576e5634701bd583e196877856

  • SHA1

    5a75ec4ddc5f7cc2f30d8a289f91c8f62067ffaf

  • SHA256

    f07d13e42a388a55a358a07cfdcb04d0dcb4ac4219b6805372dea3567d97f591

  • SHA512

    8f9efe1e3fbc2e6a464b4347e597a67573a412525bac228413503af4661dcca6b4021425c6c7d117128444c4362466858b7395514e445775654a9e7834ac03fa

  • SSDEEP

    12288:UHafApk9jQrYuqyVJ5XAn29p42Ng0aYO0p/hNXda5vcmjLI20mNv:U6fAu9sFxX9pv9W4TsNjLIG

  Score

  10^/10

  agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2