Extracted

• • Target

    New Purchase Order list order no. Hc511 Uv7343.exe

  • Size

    678KB

  • MD5

    a0f15d3c74920deadb2adc95cedae90f

  • SHA1

    c0f72be558e297f7603a69e0a556b9471928367e

  • SHA256

    47c97ee0cd727da073dd44ae9a93e8d6a18eb8ec85aed8b4a9f9e77e9ce26266

  • SHA512

    2e4aeaa296d9d1bf7c6de48e877b1dbcfacbd8c1ba4b01ca4863a523988b8a0ce0805c555cdcde8c14a102806260e929557ab5a9475ca244593914399b9319ce

  • SSDEEP

    6144:ufpHAgbCa8sGQT840nZuvBdHI6WTJ1JK6ipY9ID382FI1JtpkmOdd0b6Wyu:uxHX8kT8ZiITJu6tGs+ODpkG

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerpersistenceprivilege_escalationspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2